The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerability in Windows Kernel Allows Elevation of Privilege (MS08-025)
------------------------------------------------------------------------
SUMMARY
This security update resolves a privately reported vulnerability in the
Windows kernel. A local attacker who successfully exploited this
vulnerability could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts.
This is an important security update for all supported editions of Windows
2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server
2008. For more information, see the subsection, Affected and Non-Affected
Software, in this section.
DETAILS
Affected Software:
Operating System - Maximum Security Impact - Aggregate Severity Rating -
Bulletins Replaced by this Update
*
<http://www.microsoft.com/downloads/details.aspx?familyid=8db9f328-da0e-4fb8-96c4-6d368b47c224>
Microsoft Windows 2000 Service Pack 4 - Elevation of Privilege - Important -
None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=0e937f65-abd0-46dd-8883-5bfd70ea1178>
Windows XP Service Pack 2 - Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=a29bbd13-761f-44fa-8948-e1a8c244bd7a>
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition
Service Pack 2 - Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=d3b855a6-4648-4771-826d-11a151828eac>
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 -
Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=320fd100-35e1-4345-9399-796393235cbc>
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service
Pack 2 - Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=126426a7-be38-4327-89db-02d99d76589d>
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003
with SP2 for Itanium based Systems - Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=9640cd8b-d749-4ddd-8af9-b298cebed969>
Windows Vista and Windows Vista Service Pack 1 - Elevation of Privilege -
Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=d56bb4fe-304e-45e0-95f2-fde2f47b2a04>
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 -
Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=4497333c-9418-4b91-83dc-0155735421c0>
Windows Server 2008 for 32-bit Systems - Elevation of Privilege - Important -
None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=5aefc7a6-79a4-45a2-b534-35d0ec400dda>
Windows Server 2008 for x64-based Systems - Elevation of Privilege - Important
- None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=3080c26b-7456-41ef-8668-28f15bc7b8ce>
Windows Server 2008 for Itanium-based Systems - Elevation of Privilege -
Important - None
Windows Kernel Vulnerability - CVE-2008-1084
An elevation of privilege vulnerability exists due to the Windows kernel
improperly validating input passed from user mode to the kernel. The
vulnerability could allow an attacker to run code with elevated
privileges. An attacker who successfully exploited this vulnerability
could execute arbitrary code and take complete control of an affected
system. An attacker could then install programs; view, change, or delete
data; or create new accounts with full user rights.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1084>
CVE-2008-1084
Mitigating Factors for Windows Kernel Vulnerability - CVE-2008-1084
An attacker must have valid logon credentials and be able to log on
locally to a vulnerable system in order to exploit this vulnerability. The
vulnerability could not be exploited remotely or by anonymous users.
FAQ for Windows Kernel Vulnerability - CVE-2008-1084
What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who
successfully exploited this vulnerability could execute arbitrary code and
take complete control of an affected system. An attacker could then
install programs; view, change, or delete data; or create new accounts
with full user rights.
What causes the vulnerability?
The Windows kernel improperly validating input passed from user mode to
the Kernel.
What is the Windows kernel?
The Windows kernel is the core of the operating system. It provides system
level services such as device management and memory management, it
allocates processor time to processes, and it manages error handling.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could run
arbitrary code in kernel mode. An attacker could then install programs;
view, change, or delete data; or create new accounts with full user
rights.
How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to
the system. An attacker could then run a specially crafted application
that could exploit the vulnerability and take complete control over the
affected system.
What systems are primarily at risk from the vulnerability?
Any Windows system that allowed potentially hostile users to log on
locally could be at risk from this vulnerability. Windows XP Service Pack
3 is not affected by this Vulnerability.
What does the update do?
The update removes the vulnerability by correctly validating parameters
passed to the Windows Kernel by user mode callbacks.
When this security bulletin was issued, had this vulnerability been
publicly disclosed?
No. Microsoft received information about this vulnerability through
responsible disclosure. Microsoft had not received any information to
indicate that this vulnerability had been publicly disclosed when this
security bulletin was originally issued.
When this security bulletin was issued, had Microsoft received any reports
that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers and had not seen
any examples of proof of concept code published when this security
bulletin was originally issued.
ADDITIONAL INFORMATION
The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/Bulletin/MS08-025.mspx>
http://www.microsoft.com/technet/security/Bulletin/MS08-025.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
