PT-2010-1177 · Microsoft · Windows Server 2003+6

Tavis Ormandy · Published 2010-01-21 · Updated 2025-04-04 · CVE-2010-0232

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows NT versions 3.1 through 7 Microsoft Windows 2000 version SP4 Microsoft Windows XP versions SP2 and SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions Gold, SP1, and SP2 Microsoft Windows Server 2008 versions Gold and SP2

Description The issue is related to the kernel in Microsoft Windows not properly validating certain BIOS calls when access to 16-bit applications is enabled on a 32-bit x86 platform. This allows local users to gain privileges by crafting a VDM TIB data structure in the Thread Environment Block (TEB) and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (NTVDM) subsystem. The vulnerability involves improperly handled exceptions, including the #GP trap handler (nt!KiTrap0D). An attacker who successfully exploits this issue could run arbitrary code in kernel mode, potentially allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows NT versions 3.1 through 7, update to a version that includes the fix for this issue. For Microsoft Windows 2000 version SP4, apply the recommended patch or update to a newer version. For Microsoft Windows XP versions SP2 and SP3, apply the recommended patch or update to a newer version. For Microsoft Windows Server 2003 version SP2, apply the recommended patch or update to a newer version. For Microsoft Windows Vista versions Gold, SP1, and SP2, apply the recommended patch or update to a newer version. For Microsoft Windows Server 2008 versions Gold and SP2, apply the recommended patch or update to a newer version. As a temporary workaround, consider disabling access to 16-bit applications on 32-bit x86 platforms to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-264

CWE-755

Related Identifiers

BDU:2022-04042

CVE-2010-0232

Affected Products

Windows

Windows 2000

Windows Nt

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 28

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms10_015_kitrap0d.rb · Exploit
• 🔥 https://exploit-db.com/exploits/11199 · Exploit
• 🔥 http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip · Exploit
• 🔥 http://seclists.org/fulldisclosure/2010/Jan/341 · Exploit
• 🔥 http://securityfocus.com/bid/37864 · Exploit
• https://safe-surf.ru/specialists/base-vulnerabilities/464542 · Security Note
• https://bdu.fstec.ru/vul/2022-04042 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0232 · Security Note
• http://vupen.com/english/advisories/2010/0179 · Vendor Advisory
• http://microsoft.com/technet/security/advisory/979682.mspx · Vendor Advisory
• http://secunia.com/advisories/38265 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0232 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-015 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55742 · Note