Just clarifying the description of this vulnerability.
if hosta is flagged as the source of searching via SMB to hostb for phoneinfo.dll, is the vulnerability in 37558 talking about a vulnerability that might have occured on hosta that caused the result on hostb? Or is FMC thinking that hosta carried out a potential exploit attempt?
The attachment shows hosta connecting to a server hostb. Hosta is a non technical person with a mapped drive to hostb (server).
Some info:
Abstract
A DLL side loading vulnerability was found in the MapsUpdateTask Task DLL that ships with Windows 10. This issue can be exploited by loading COM control as an embedded OLE object. When instantiating the object Windows will try to load the DLL phoneinfo.dll from the current working directory. If an attacker convinces the user to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.
Introduction
OLE is a technology that enables an application to create compound documents that contain information from a number of different sources. For example, a document in an OLE-enabled word processor can accept an embedded spreadsheet object. Unlike traditional "cut and paste" methods where the receiving application changes the format of the pasted information, embedded documents retain all their original properties. If the user decides to edit the embedded data, Windows activates the originating application and loads the embedded document.
OLE objects are loaded via a CLSID or indirectly via a programmatic identifier (ProgID). The CLSID is used to look up its associated DLL in the Windows Registry. In order to check if the provided CLSID is in fact an OLE object, this DLL needs to be loaded in memory first, even if the CLSID is not really an OLE object. Since the DLL may not be designed to be loaded this way, loading it can introduce security issues like side loading of malicious DLLs.
Vulnerability details
It was discovered that in the MapsUpdateTask Task DLL of Windows is affected by DLL side loading. Loading the COM control with CLSID {B9033E87-33CF-4D77-BC9B-895AFBBA72E4} as an OLE object will result in Windows trying to load the DLL phoneinfo.dll from the current working directory.
