PT-2013-3054 · Microsoft · Windows Vista+4
George Georgiev Valkov
·
Publicado
2013-04-09
·
Atualizado
2023-12-07
·
CVE-2013-1295
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows XP versions SP2 through SP3
Microsoft Windows Server 2003 version SP2
Microsoft Windows Vista version SP2
Microsoft Windows Server 2008 version SP2
Description
The issue arises from improper handling of objects in memory by the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows. This allows local users to gain privileges via a crafted application. An elevation of privilege vulnerability exists when the Windows CSRSS improperly handles objects in memory, enabling an attacker to run arbitrary code in the context of the local system. This could allow the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Windows XP versions SP2 through SP3, update to a version that properly handles objects in memory to prevent privilege escalation.
For Microsoft Windows Server 2003 version SP2, apply the necessary patch to fix the CSRSS memory corruption issue.
For Microsoft Windows Vista version SP2, ensure that the system is updated to prevent the exploitation of the CSRSS vulnerability.
For Microsoft Windows Server 2008 version SP2, apply the relevant security update to address the elevation of privilege vulnerability in the CSRSS.
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Windows
Windows Server 2003
Windows Server 2008
Windows Vista
Windows Xp