CVE-2013-5659
📋 TL;DR
CVE-2013-5659 is a memory corruption vulnerability in Wiz 5.0.3 that allows user-mode write access violations. This could enable attackers to execute arbitrary code or cause denial of service. Users running Wiz 5.0.3 are affected.
💻 Affected Systems
- Wiz
📦 What is this software?
Wiz by Info Zip
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Application crash or denial of service
If Mitigated
Limited impact with proper memory protection controls
🎯 Exploit Status
Proof of concept available in public disclosures
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.4 or later
Vendor Advisory: http://realpentesting.blogspot.com/p/realpentesting-advisory-title-user-mode.html
Restart Required: Yes
Instructions:
1. Download latest Wiz version from official source. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Wiz application
Use firewall rules to block inbound/outbound traffic to Wiz
Memory Protection
windowsEnable DEP and ASLR protections
bcdedit /set {current} nx AlwaysOn
Enable ASLR via system settings
🧯 If You Can't Patch
- Remove Wiz 5.0.3 from production systems
- Implement strict network segmentation and monitoring
🔍 How to Verify
Check if Vulnerable:
Check Wiz version in Help > About menuCheck Version:
wiz --version or check Help > AboutVerify Fix Applied:
Verify version is 5.0.4 or higher📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unexpected process termination
Network Indicators:
- Unusual network traffic to Wiz ports
- Connection attempts from unknown sources
SIEM Query:
EventID=1000 OR EventID=1001 Source=Wiz.exe