-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0039
       Vulnerability in Windows Kernel Could Allow Security Feature
                             Bypass (2644615)
                              11 January 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Microsoft Windows
Publisher:         Microsoft
Operating System:  Windows XP
                   Windows Server 2003
                   Windows Vista
                   Windows Server 2008
                   Windows 7
                   Windows Server 2008 R2
Impact/Access:     Administrator Compromise -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-0001  

Original Bulletin: 
   http://technet.microsoft.com/en-us/security/bulletin/ms12-001

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS12-001 - Important

Vulnerability in Windows Kernel Could Allow Security Feature Bypass (2644615)

Published Date: January 10, 2012

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft
Windows. The vulnerability could allow an attacker to bypass the SafeSEH
security feature in a software application. An attacker could then use other
vulnerabilities to leverage the structured exception handler to run arbitrary
code. Only software applications that were compiled using Microsoft Visual C++
.NET 2003 can be used to exploit this vulnerability.

This security update is rated Important for supported x64-based editions of
Windows XP and all supported editions of Windows Server 2003, Windows Vista,
Windows Server 2008, Windows 7, and Windows Server 2008 R2. For more
information, see the subsection, Affected Software, in this section.

Affected Software

Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2*
Windows Server 2008 for x64-based Systems Service Pack 2*
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1*
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

*Server Core installation affected. This update applies, with the same
severity rating, to supported editions of Windows Server 2008 or Windows
Server 2008 R2 as indicated, whether or not installed using the Server Core
installation option. For more information on this installation option, see the
TechNet articles, Managing a Server Core Installation and Servicing a Server
Core Installation. Note that the Server Core installation option does not
apply to certain editions of Windows Server 2008 and Windows Server 2008 R2;
see Compare Server Core Installation Options.

Vulnerability Information

Windows Kernel SafeSEH Bypass Vulnerability - CVE-2012-0001

A security feature bypass vulnerability exists in Windows due to the way the
kernel loads the structured exception handling tables. An attacker who
successfully exploited this vulnerability could bypass the SafeSEH
defense-in-depth mechanism to facilitate exploitation of other vulnerabilities.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTwzPT+4yVqjM2NGpAQJu6BAAkB3+VAGnKdFWq+LRc274XlC3pgcTgmW5
jSeEssFePvkyEL23+Rl8K2Of2lR0koUlw4lhF8yV2hwYqAsmGf2rGxh1g+EeaFKP
GOO09sJR/cX1TGHcCoLXCYBkwQXU50IWk54mHa6oeFSLgj2wwPygvWUnIkPxYdBh
4VcYes4eXYinjeEKz/TUDxNPdHINlKDdwNQ/hWbN0uhzRu2FejOjFx1oE8F38JLc
ixyUe3ji93YXnWqAFQcdo3oB4tf2Nng17Dzobzc4yXhv/tAHYVqP87/M3EmhNDja
Ch5vaPRtPjs+EV3vQcXWnbCis9wUgs2BBa4wKhAL25syCA9h/7jxgeVfjJj1Vuef
m4rZ5vmqWGzwHm6yZjtsAfgv6Z0TS/NwBMxpvKxBY2PJ6jvHa5gjti3VU428ymyH
jpO1VPDLsXIwg5XN+1ZdCDb21GNHXmlcnUKrGxqxgDyOPHsGB0entkg1YaYkgGmS
NxwbL0doJbCB6WVZuQuBUQXyjEzgb7XvEP6qsMK5JX+nsld5E/q9g6zn8FMYmSNC
/28y430kbbT5vus6azmaRmyH2kWFzjXPZw4KHWIiI0TXQ7gRe3SSgZfqVEiFdeSO
BED7cFcf8lwasj7uGEhlHWoP3dONcHVY7as1SCDgpJ1lzpui0PRcny+fUHq2QPcx
78+h5+FwMys=
=ttZe
-----END PGP SIGNATURE-----