0

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform.

Recorded Future Blog: https://www.recordedfuture.com/blog/

Specific Post: Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018

Within that post, Recorded Future states the following:

Additionally, there are no mitigating factors available to prevent CVE-2016-0189 — the only workarounds are restricting access to two common dynamic-linked library files: VBScript.dll and JScript.dll.

Question 1: What exactly does it mean to restrict access to VBScript.dll and JScript.dll?

Question 2: How best to do this with PowerShell or Group Policy at scale?

Improve this question
0

2 Answers 2

Reset to default
0

Point 1 - Restricting access means to block certain user groups from accessing these files. You don't want them to use them or interact with them.

Addressing point 2 - how to restrict access, I suggest using App Locker to block this.

  1. In Local Security Policy, expand Application Control Policies -> AppLocker

    1a. Before proceeding - select configure rule enforcement -> advanced -> Enable DLL rule collection, apply -> back to enforcement tab, at the bottom under DLL rules: check configured and then press ok.

  2. Right click DLL Rules -> Create New Rule

  3. Select Deny and the user or group who it should be denied to

  4. Since the Path of the file can be changed, select the File Hash option for blocking

  5. Browse to the file in question, and add it

  6. Create!

Improve this answer
6
  • 2
    For DLLs you can't use the normal AppLocker rules. You need a DLL rule.
    – Polynomial
    Commented Mar 20, 2019 at 13:36
  • Edited to reflect the DLL rule - thanks.
    – Crumblez
    Commented Mar 20, 2019 at 13:41
  • Very uncertain how restricting user groups would impact normal browsing behaviors, and, how effective this method is. Any additional info is welcome.
    – RealDrGordonFreeman
    Commented Mar 20, 2019 at 13:53
  • You can restrict non administrative users from accessing the VBScript.dll file. Standard users on the floor would not be administrators and so would not be able to access the VBS dll.
    – Crumblez
    Commented Mar 20, 2019 at 14:22
  • Okay. I've given your answer a try. Now searching for a good way to test if it functions as intended.
    – RealDrGordonFreeman
    Commented Mar 20, 2019 at 21:03
0

One simple approach would be to add a "Deny read&execute" ACE to those 2 files, using cacls or icacls. On Windows 7 and later, this does not impact the system at all, provided you don't use VBS scripts obviously. Not sure about the exact command-line syntax, though.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .