Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Security Bulletin states that the "Maximum Security Impact" is "Elevation of Privilege"; however, the SRD blog post says code execution is possible. Additionally, SRD says "Other software that enables low-level pass-through of USB device enumeration may open additional avenues of exploitation that do not require direct physical access to the system". Further, the March Summary indicates that an exploit is likely for this vulnerability. Given all of this, how is the "Aggregate Severity Rating" not Critical? Once scenario that I'm now worried about is the maid walking around at night, owning all of the desktops on my trading floor, or any other Windows based corporate device.

EDIT: Here is the white paper the researcher published on the topic of USB.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

I believe it may be due to the fact that it requires local access. Without low level passthrough's to USB, this can't be remotely exploited so the potential risk is fairly limited. High security environments should already have physical security to prevent rogue USB devices being installed and lower security is less of a critical target for a local targeted attack. It's probably the limitation of scope as opposed to the limited potential harm to one particular system.

Whether that is a good way to measure severity or not is hard to say, but that is my best guess as to where they are coming from.

share|improve this answer
In the SRD blog post they mention that you do not necessarily need local access. Per the blog post "Other software that enables low-level pass-through of USB device enumeration may open additional avenues of exploitation that do not require direct physical access to the system". I interpret that to mean that a malicious executable could crafted to exploit this. So a logged in user must click on something to be owned, or someone would need physical access to own a machine with no one logged in. –  Joe Gatt Mar 13 '13 at 19:49
@JoeGatt - yes, I made mention of that in my post. Low level pass through of that type is not common. It is mostly seen with things like VMs or things where a virtual driver is used for a USB port. It is a rare case and would require some other means of exploit to make such a low level device on a system that doesn't already have a software device configured to appear as a USB host. –  AJ Henderson Mar 13 '13 at 20:37
Interesting perspective. I hadn't considered the difficulty in what it would take to create malware to install a software device configured to appear as a USB host. –  Joe Gatt Mar 13 '13 at 22:55
add comment

It is the same case of Redhat explaining in their blog post why they use CVSS and don't take into account the environment and temporal (time based) values. Your question is directly related to this same procedure.

The reason why microsoft has not flagged this as overall critical is because of the environmental factor. A lot of organizations already have physcial security in place with with zero tolerance for USB devices. Even if code execution is possible, it is not remote. Attacker needs to have physical access to the machine to trigger the bug. Although just plugging in a flash drive is fast, but I think if you have phyiscal access to the system, USB is not the only vector you can compromise.

Therefore, taking into account the overall exploitation vector and the fact what new attack avenues this particular bug can introduce in an environment, the vulnerability is not rated as critical.

share|improve this answer
Per the SRD blog post "This update represents an expansion of our risk assessment methodology to recognize vulnerabilities that may require physical access, but do not require a valid logon session". Physical environment is now in scope for Microsoft advisories. I think @AJHenderson answered the question best. –  Joe Gatt Mar 14 '13 at 10:12
add comment

I'd say that as @AJHenderson says their rating of Important is down to the requirement for physical access.

That said as with any vulnerability the actual risk to an environment needs to be assessed based on the likely threats to systems and their accessibility. In some companies the risk of this attack will be quite low (e.g. datacentre environments where physical access to systems is extremely limited), whereas in others it will be high where access is easy (e.g. any kiosk style environments that allow USB access) or where likely threat actors can get physical access to systems (e.g. financial organisations who may allow contract staff like cleaners physical access to systems (think sumitomo bank))

Ultimately I'd say that the Microsoft rating should just be seen as a starting point for a companies risk assessment and they need to take account of their own environment before deciding on how severely to treat a given issue.

share|improve this answer
I wish I could "accept" two answers. Your point about risk assessment in the context of the organization is spot on. –  Joe Gatt Mar 14 '13 at 10:20
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.