CERT-In Vulnerability Note
CIVN-2010-0206
Microsoft LSASS ADAM/ADLDS Privilege Escalation Vulnerability
Original Issue Date:September 16, 2010
Severity Rating: MEDIUM
Systems Affected
- Microsoft Windows XP Service Pack 3
- Microsoft Windows XP Professional x64 Edition Service Pack 2
- Microsoft Windows Server 2003 Service Pack 2
- Microsoft Windows Server 2003 x64 Edition Service Pack 2
- Microsoft Windows Server 2003 SP2 (Itanium)
- Microsoft Windows Vista Service Pack 2
- Microsoft Windows Vista x64 Edition Service Pack 2
- Microsoft Windows Server 2008 (32-bit)
- Microsoft Windows Server 2008 (32-bit) Service Pack 2
- Microsoft Windows Server 2008 (x64)
- Microsoft Windows Server 2008 (x64) Service Pack 2
- Microsoft Windows 7 (32-bit)
- Microsoft Windows 7 (x64)
- Microsoft Windows Server 2008 R2 (x64)
Overview
A Vulnerability has been reported in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) of Microsoft windows. Successful exploitation of this vulnerability could allow an attacker to execute an arbitrary code and take complete control of an affected system.
Description
The Local Security Authority Subsystem Service (LSASS) provides an interface for managing local security, domain authentication, and Active Directory service processes. LSASS handles authentication for the client and for the server. LSASS also contains features for supporting Active Directory utilities.
A remote privilege-escalation vulnerability exists in Microsoft Windows due to a heap overflow error in the Local Security Authority Subsystem Service (LSASS) when handling Lightweight Directory Access Protocol (LDAP) messages in certain implementations of Active Directory, Active Directory Application Mode (ADAM). An authenticated attacker could exploit this vulnerability by sending specially crafted LDAP messages to a listening LSASS server. Successful exploitation of this vulnerability could allow an attacker to execute an arbitrary code and take complete control of an affected system with full user rights.
Workaround
- Block TCP port 389 at the Perimeter
Solution
Apply patches as mentioned in Microsoft Security bulletin
MS10-068
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-068.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-068.mspx
Symantec
http://www.symantec.com/connect/blogs/microsoft-patch-tuesday-september-2010
Vupen
http://www.vupen.com/english/advisories/2010/2389
Security Tracker
http://securitytracker.com/alerts/2010/Sep/1024443.html
CVE Name
CVE-2010-0820
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|