Microsoft ended support for Internet Explorer on June 15, 2022. However, IE’s deep integration into the Windows operating system means that each Windows host still has an IE-specific Event Log. This Event Log and its distinct set of permissions have ramifications that are being felt to this day, specifically via two exploits targeting Windows systems that were recently discovered by Varonis: LogCrusher and Overlog.
LogCrusher can allow any domain user to remotely crash the Event Log application of any Windows machine on the current domain. This could be particularly useful for a malicious actor as a way to cover their tracks before performing an attack on a system. OverLog can cause a remote denial-of-service (DoS) attack by inflating this Event Log file, to the point of entirely filling up the hard drive space of any Windows machine on the current domain.
A partial patch was released on October 11, 2022 to address this. However, Microsoft has also opted not to fully fix the LogCrusher vulnerability on Windows 10.
Windows 11 and Windows Server 2022 are unaffected.
To read the entire breakdown of both exploits, visit Varonis’ site for their full report: https://www.varonis.com/blog/the-logging-dead-two-windows-event-log-vulnerabilities
