PT-2009-4381 · Microsoft · Windows Server 2003+4

Nikita Tarakanov · Publicado 2009-08-12 · Atualizado 2019-02-26 · CVE-2009-1922

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold

Description: The issue concerns the Message Queuing (MSMQ) service, which does not properly validate unspecified IOCTL request data from user mode before passing it to kernel mode. This allows local users to gain privileges via a crafted request.

Recommendations: For Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold, update to a newer version to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1922

Produtos afetados

Msmq

Windows 2000

Windows Server 2003

Windows Vista

Windows Xp

Referências · 9

• http://osvdb.org/56901 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6109 · Nota
• http://securitytracker.com/id?1022714 · Nota
• http://securityfocus.com/archive/1/505691/100/0/threaded · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-040 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1922 · Nota de Segurança
• http://secunia.com/advisories/36214 · Aviso do Fabricante
• http://en.securitylab.ru/lab/PT-2008-09 · Nota
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Nota