PT-2011-3544 · Microsoft · Ancillary Function Driver+1

Bo Zhou · Published 2011-10-11 · Updated 2025-04-04 · CVE-2011-2005

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Ancillary Function Driver (afd.sys) versions prior to the fixed version

Description The issue is related to improper input validation in the Ancillary Function Driver, allowing local users to gain privileges via a crafted application. This vulnerability enables an attacker to execute code with elevated privileges, potentially leading to full control over the system, including the ability to install programs, view, modify, and delete data, and create new accounts with full administrator rights.

Recommendations For Microsoft Ancillary Function Driver (afd.sys), update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2011-2005

Affected Products

Ancillary Function Driver

Windows

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/21844 · Exploit
• 🔥 https://exploit-db.com/exploits/18176 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2005 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2005 · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-080 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13114 · Note
• https://t.me/cvenotify/104960 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cvenotify/117756 · Telegram Post
• https://t.me/cvenotify/85573 · Telegram Post