PT-2011-2036 · Microsoft · Windows

Jorge Moura · Published 2011-02-08 · Updated 2018-10-12 · CVE-2011-0039

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue concerns the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows, which does not properly process authentication requests. This allows local users to gain privileges via a request with a crafted length. An elevation of privilege vulnerability exists in the way that LSASS processes specially crafted authentication requests, which could allow an attacker to run code with elevated privileges and take complete control of an affected system.

Recommendations For Microsoft Windows versions prior to the fixed version: update to the fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-0039

Affected Products

Windows

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-014 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0327 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-0039 · Security Note
• http://secunia.com/advisories/43253 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12537 · Note
• http://securitytracker.com/id?1025049 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-014 · Note
• http://securityfocus.com/bid/46152 · Note