PT-2009-5049 · Microsoft · Win32K.Sys+2

Published 2009-08-03 · Updated 2024-08-07 · CVE-2009-2653

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 versions prior to SP1

Description The issue allows local administrators to bypass unspecified security software and gain privileges via a crafted call that triggers an overwrite of an arbitrary memory location. The vendor disputes the significance of this report, stating that the Administrator to SYSTEM escalation is not a security boundary they defend.

Recommendations For Microsoft Windows XP versions SP2 through SP3, there is no information about a newer version that contains a fix for this issue. For Microsoft Windows Server 2003 versions prior to SP1, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the NtUserConsoleControl function in win32k.sys to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2653

Affected Products

Windows Server 2003

Windows Xp

Win32K.Sys

References · 9

• 🔥 http://ntinternals.org/index.html#09_07_30 · Exploit
• 🔥 http://hi.baidu.com/azy0922/blog/item/f950cbc2890729130ef47783.html · Exploit
• 🔥 http://exploit-db.com/exploits/9301 · Exploit
• 🔥 https://exploit-db.com/exploits/9301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2653 · Security Note
• https://t.me/cvenotify/89578 · Telegram Post
• http://blogs.technet.com/srd/archive/2009/06/11/latest-baidu-public-posting-requires-adminisrator-to-elevate.aspx · Note
• http://securitytracker.com/id?1022630 · Note
• http://osvdb.org/56780 · Note