PT-2011-2036 · Microsoft · Windows

Jorge Moura · Publicado 2011-02-08 · Atualizado 2018-10-12 · CVE-2011-0039

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue concerns the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows, which does not properly process authentication requests. This allows local users to gain privileges via a request with a crafted length. An elevation of privilege vulnerability exists in the way that LSASS processes specially crafted authentication requests, which could allow an attacker to run code with elevated privileges and take complete control of an affected system.

Recommendations For Microsoft Windows versions prior to the fixed version: update to the fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-0039

Produtos afetados

Windows

Referências · 9

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12537 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-014 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0327 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0039 · Nota de Segurança
• http://securitytracker.com/id?1025049 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-014 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0039 · Nota de Segurança
• http://securityfocus.com/bid/46152 · Nota
• http://secunia.com/advisories/43253 · Aviso do Fabricante