Windows Client-Server Run-time Subsystem Bugs Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1025762 |
|
SecurityTracker URL: http://securitytracker.com/id/1025762
|
|
CVE Reference:
CVE-2011-1281, CVE-2011-1282, CVE-2011-1283, CVE-2011-1284, CVE-2011-1870
(Links to External Site)
|
Date: Jul 12 2011
|
Impact:
Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): XP SP3, 2003 SP2, Vista SP2, 2008 SP2, 7 SP1, 2008 R2 SP1; and prior service packs
|
Description:
Several vulnerabilities were reported in Windows Client-Server Run-time Subsystem. A local user can obtain elevated privileges on the target system.
A local user can run a specially crafted program that exploits a flaw in the AllocConsole command to obtain the object handle to extra console objects that have been orphaned by another process and execute arbitrary code on the target system with kernel privileges [CVE-2011-1281].
A local user can run a specially crafted program that exploits a flaw in the SrvSetConsoleLocalEUDC command to trigger a memory corruption error and execute arbitrary code on the target system with kernel privileges [CVE-2011-1282].
A local user can run a specially crafted program that exploits an array index validation flaw in the SrvSetConsoleNumberOfCommand command to execute arbitrary commands on the target system with elevated privileges [CVE-2011-1283].
A local user can run a specially crafted program that exploits a flaw in the SrvWriteConsoleOutput command to trigger an integer overflow and execute arbitrary code on the target system with kernel privileges [CVE-2011-1284].
A local user can run a specially crafted program that exploits a flaw in the SrvWriteConsoleOutputString command to trigger an integer overflow and execute arbitrary commands on the target system with kernel privileges [CVE-2011-1870].
Matthew 'j00ru' Jurczyk of Hispasec Virustotal reported these vulnerabilities.
|
Impact:
A local user can obtain kernel mode privileges on the target system.
|
Solution:
The vendor has issued the following fixes:
Windows XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=425C705E-94F2-4FA6-9DF2-DC71897215FA
Windows XP Professional x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=C389FA20-677E-49B6-AF44-781E5522D08B
Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=DFF4C67A-8C8B-4D7D-84C7-57429BECF0FF
Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=1615A995-9A04-440A-AE52-5917738F0ECB
Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=A81C011D-EEEA-4383-9EFB-DF70515AB357
Windows Vista Service Pack 1 and Windows Vista Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=A5E192AF-DAE5-47EF-A9D0-F761A8CAA974
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=1007F5D3-9BE1-4F03-A3F0-12DDB555653C
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=36E3DBAF-36F5-4C74-8F11-ECBEF46F58E1
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=B43D2AB5-E281-4C6B-BB37-1F1B5D86AC82
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=B70209F2-1C51-45AF-B3C4-3473AEBCDB35
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=AC3B435C-8CAF-40CC-8F13-B52261B3B9E6
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=64E5F889-FA46-4884-9B22-3BA4E2FBA1B9
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=B99A40CF-8A31-43D9-BD0B-A458A533068B
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=784EFC20-3A41-42AB-B48D-51FD59D71523
A restart is required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms11-056.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms11-056.mspx (Links to External Site)
|
Cause:
Access control error, Boundary error, Input validation error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
