CERT-In Vulnerability Note
CIVN-2005-0115
Local Privilege Escalation Vulnerability in Windows Kernel
Original Issue Date:December 14, 2005
Severity Rating: MEDIUM
Systems Affected
Microsoft Windows 2000 Service Pack 4
Overview
A vulnerability has been reported in the Microsoft Windows Kernel which could allow an attacker to obtain elevate privileges and take complete control of the system.
Description
This vulnerability is caused due to an error in the thread termination routine used in the asynchronous procedure call APC queue list. An asynchronous procedure call APC is a function which executes asynchronously in the context of a particular thread. To exploit this vulnerability, an attacker first has to log on locally to the system and execute run a specially-crafted application.
An attacker who successfully exploits this vulnerability could take complete control of the system. This vulnerability could not be exploited remotely or by anonymous user.
Solution
Apply appropriate security update as mentioned in the Microsoft Security Bulletin
MS05-055
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS05-055.mspx
References
eEye Digital Security: AD20051213
http://www.eeye.com/html/research/advisories/AD20051213.html
Secunia Advisory
http://secunia.com/advisories/15821/
BID:15826
http://www.securityfocus.com/bid/15826
CVE Name
CAN-2005-2827
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|