Vulnerability

CERT-In Vulnerability Note CIVN-2010-0207
Windows Client/Server Runtime Subsystem Vulnerability

Original Issue Date:September 16, 2010

Severity Rating: MEDIUM

Systems Affected

Microsoft Windows XP SP3
Microsoft Windows XP Professional x64 Edition SP2
Windows Server 2003 SP 2
Windows Server 2003 x64 Edition SP2
Windows Server 2003 SP 2 (Itanium)

Overview

A vulnerability has been reported in Microsoft Windows Client/Server Runtime Subsystem, which could allow a local attacker to execute arbitrary code and take complete control of the affected system in the context of logged in user.

Description

The Client/Server Runtime Subsystem (CSRSS) is the user-mode portion of the Win32 subsystem which is responsible for console windows, creating and/or deleting threads.

This vulnerability is caused due to a heap overflow error in the Windows Client/Server Runtime Subsystem (CSRSS) because of insufficient memory allocation when handling specific user transactions on Windows systems that are configured with a Chinese, Japanese, or Korean system locale. This vulnerability could be exploited by malicious users to gain elevated privileges of the affected system.

Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code with system privileges and take complete control of the affected system in the context of logged in user.

Solution

Apply patches as mentioned in Microsoft Security bulletin MS10-069

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-069.mspx

References

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-069.mspx

Vupen
http://www.vupen.com/english/advisories/2010/2390

Security Tracker
http://securitytracker.com/alerts/2010/Sep/1024444.html

SecurityFocus
http://www.securityfocus.com/bid/43121

CVE Name
CVE-2010-1891

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India