PT-2013-3054 · Microsoft · Windows Vista+4
George Georgiev Valkov
·
Published
2013-04-09
·
Updated
2023-12-07
·
CVE-2013-1295
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows XP versions SP2 through SP3
Microsoft Windows Server 2003 version SP2
Microsoft Windows Vista version SP2
Microsoft Windows Server 2008 version SP2
Description
The issue arises from improper handling of objects in memory by the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows. This allows local users to gain privileges via a crafted application. An elevation of privilege vulnerability exists when the Windows CSRSS improperly handles objects in memory, enabling an attacker to run arbitrary code in the context of the local system. This could allow the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Windows XP versions SP2 through SP3, update to a version that properly handles objects in memory to prevent privilege escalation.
For Microsoft Windows Server 2003 version SP2, apply the necessary patch to fix the CSRSS memory corruption issue.
For Microsoft Windows Vista version SP2, ensure that the system is updated to prevent the exploitation of the CSRSS vulnerability.
For Microsoft Windows Server 2008 version SP2, apply the relevant security update to address the elevation of privilege vulnerability in the CSRSS.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows
Windows Server 2003
Windows Server 2008
Windows Vista
Windows Xp