AusCERT - ESB-2010.0136 - [Win] Windows Kernel: Administrator compromise

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2010.0136 - [Win] Windows Kernel: Administrator compromise - Existing account
Date: 10 February 2010
References: ASB-2010.0019

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2010.0136
   Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
                             10 February 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Windows Kernel
Publisher:         Microsoft
Operating System:  Windows 2000
                   Windows XP
                   Windows Server 2003
                   Windows Server 2008
                   Windows Vista
                   Windows 7
Impact/Access:     Administrator Compromise -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-0233 CVE-2010-0232 

Reference:         ASB-2010.0019

Original Bulletin: 
   http://www.microsoft.com/technet/security/Bulletin/MS10-015.mspx

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS10-015 - Important

Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165)

Published: February 09, 2010

Version: 1.0

General Information

Executive Summary

  This security update resolves one publicly disclosed and one privately 
  reported vulnerability in Microsoft Windows. The vulnerabilities could 
  allow elevation of privilege if an attacker logged on to the system and 
  then ran a specially crafted application. To exploit either 
  vulnerability, an attacker must have valid logon credentials and be able 
  to log on locally. The vulnerabilities could not be exploited remotely 
  or by anonymous users.

  This security update is rated Important for all supported editions of 
  Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, 
  Windows Server 2008, and Windows 7 for 32-bit Systems. 

  The security update addresses the vulnerabilities by ensuring that the 
  Windows Kernel handles exceptions properly. 

  This security update also addresses the vulnerability first described 
  in Microsoft Security Advisory 979682.

  Recommendation.  The majority of customers have automatic updating 
  enabled and will not need to take any action because this security 
  update will be downloaded and installed automatically. Customers who 
  have not enabled automatic updating need to check for updates and 
  install this update manually. 

  For administrators and enterprise installations, or end users who want 
  to install this security update manually, Microsoft recommends that 
  customers apply the update at the earliest opportunity using update 
  management software, or by checking for updates using the Microsoft 
  Update service.

  Known Issues. Microsoft Knowledge Base Article 977165 documents the 
  currently known issues that customers may experience when installing 
  this security update. The article also documents recommended solutions 
  for these issues. When currently known issues and recommended solutions 
  pertain only to specific releases of this software, this article provides 
  links to further articles.

Affected Software 

  Microsoft Windows 2000 Service Pack 4
  Windows XP Service Pack 2 and Windows XP Service Pack 3
  Windows XP Professional x64 Edition Service Pack 2
  Windows Server 2003 Service Pack 2
  Windows Server 2003 x64 Edition Service Pack 2
  Windows Server 2003 with SP2 for Itanium-based Systems
  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service 
    Pack 2
  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and 
    Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit 
    Systems Service Pack 2*
  Windows Server 2008 for x64-based Systems and Windows Server 2008 for 
    x64-based Systems Service Pack 2
  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for 
    Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems

Vulnerability Information

Windows Kernel Exception Handler Vulnerability - CVE-2010-0232

  An elevation of privilege vulnerability exists in the Windows Kernel due 
  to the way the kernel handles certain exceptions. An attacker who 
  successfully exploited this vulnerability could run arbitrary code in 
  kernel mode. An attacker could then install programs; view, change, or 
  delete data; or create new accounts with full user rights.

Windows Kernel Double Free Vulnerability - CVE-2010-0233

  An elevation of privilege vulnerability exists in the Windows Kernel due 
  to a double free condition. An attacker who successfully exploited this 
  vulnerability could run arbitrary code in kernel mode. An attacker could 
  then install programs; view, change, or delete data; or create new accounts 
  with full user rights.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFLciWf/iFOrG6YcBERAtQaAJ4p42npS5JCxnKBszwB5tRFAl/f9gCeOxm2
6qK/H5VmY1RHReoSSbUA/yA=
=DvLf
-----END PGP SIGNATURE-----