PT-2013-4696 · Microsoft · Server 2008 R2 Sp1+1

Publicado 2013-09-11 · Atualizado 2018-10-12 · CVE-2013-3862

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Server 2008 R2 SP1 version prior to the fixed version

Description The issue is related to a double free vulnerability in the Service Control Manager (SCM) that allows local users to gain privileges via a crafted service description. This vulnerability exists in the way the SCM handles objects in memory, potentially allowing an attacker to execute arbitrary code and take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the fixed version to resolve the issue. For Server 2008 R2 SP1 version prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting access to the Service Control Manager (SCM) to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-3862

Produtos afetados

Windows

Server 2008 R2 Sp1

Referências · 5

• http://technet.microsoft.com/en-us/security/bulletin/ms13-077 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-077 · Aviso do Fabricante
• http://us-cert.gov/ncas/alerts/TA13-253A · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3862 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3862 · Nota de Segurança