PT-2007-2631 · Microsoft · Windows Vista+5

Publicado 2007-04-10 · Atualizado 2018-10-16 · CVE-2007-1206

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows NT 4.0 Windows 2000 SP4 Windows XP SP2 Windows Server 2003 Windows Server 2003 SP1 Windows Server 2003 SP2 Windows Vista before June 2006

Description A privilege elevation issue exists due to incorrect permissions on a mapped memory segment. This allows local users to gain privileges by modifying the zero page during a race condition before the view is unmapped. An attacker who successfully exploited this issue could take complete control of an affected system.

Recommendations For Windows NT 4.0, update the system to apply the necessary security fixes. For Windows 2000 SP4, apply the patch to fix the insecure permissions issue. For Windows XP SP2, install the update that corrects the permissions on the mapped memory segment. For Windows Server 2003, Windows Server 2003 SP1, and Windows Server 2003 SP2, apply the security patch to resolve the issue. For Windows Vista before June 2006, update the system to a version released after June 2006 to ensure the fix is applied.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-1206

Produtos afetados

Windows

Windows 2000

Windows Nt 4.0

Windows Server 2003

Windows Vista

Windows Xp

Referências · 17

• http://securityfocus.com/archive/1/archive/1/465232/100/0/threaded · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1206 · Nota de Segurança
• http://securityfocus.com/archive/1/archive/1/466331/100/200/threaded · Nota
• http://osvdb.org/34011 · Nota
• http://secunia.com/advisories/24834 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1639 · Nota
• http://securitytracker.com/id?1017898 · Nota
• http://securityfocus.com/archive/1/466331/100/200/threaded · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-022 · Nota
• http://vupen.com/english/advisories/2007/1326 · Aviso do Fabricante
• http://research.eeye.com/html/advisories/published/AD20070410a.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1206 · Nota de Segurança
• http://securityfocus.com/bid/23367 · Nota
• http://kb.cert.org/vuls/id/337953 · Nota
• http://us-cert.gov/cas/techalerts/TA07-100A.html · Nota