PT-2010-5178 · Microsoft · Windows Vista+5
Published
2010-12-16
·
Updated
2023-12-07
·
CVE-2010-3940
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows XP versions SP2 through SP3
Microsoft Windows Server 2003 version SP2
Microsoft Windows Vista versions SP1 through SP2
Microsoft Windows Server 2008 versions Gold through SP2 and R2
Microsoft Windows 7 (affected versions not specified)
Description
The issue is related to a double free vulnerability in the win32k.sys kernel-mode drivers, allowing local users to gain privileges via a crafted application. This vulnerability exists due to the way the Windows kernel-mode drivers free objects that are no longer in use. An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Windows XP versions SP2 through SP3, update to a version that includes the fix for this issue.
For Microsoft Windows Server 2003 version SP2, apply the recommended patch or update.
For Microsoft Windows Vista versions SP1 through SP2, install the security update that addresses this vulnerability.
For Microsoft Windows Server 2008 versions Gold through SP2 and R2, apply the necessary security patch.
For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows
Windows 7
Windows Server 2003
Windows Server 2008
Windows Vista
Windows Xp