PT-2013-4554 · Microsoft · Windows Rt+7

Tavis Ormandy · Published 2013-05-24 · Updated 2019-02-26 · CVE-2013-3661

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista version SP2 Microsoft Windows Server 2008 versions SP2 through R2 SP1 Microsoft Windows 7 version SP1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT

Description The issue is related to the EPATHOBJ::bFlatten function in win32k.sys, which does not properly check for continual access to the same list member during linked-list traversal. This allows local users to cause a denial of service through infinite traversal by triggering a crafted PATHRECORD chain.

Recommendations For Microsoft Windows XP versions SP2 through SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 version SP2, update to a newer version to mitigate the risk. For Microsoft Windows Vista version SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 versions SP2 through R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 version SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012, update to a newer version to mitigate the risk. For Microsoft Windows RT, update to a newer version to mitigate the risk.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-3661

Affected Products

Windows 7

Windows 8

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

References · 13

• 🔥 https://exploit-db.com/exploits/25611 · Exploit
• 🔥 https://exploit-db.com/exploits/26554 · Exploit
• 🔥 https://exploit-db.com/exploits/25912 · Exploit
• 🔥 http://exploit-db.com/exploits/25611 · Exploit
• http://secunia.com/advisories/53435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3661 · Security Note
• http://reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability · Note
• http://osvdb.org/93539 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html · Note
• http://twitter.com/taviso/statuses/335557286657400832 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html · Note
• http://theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw · Note
• http://computerworld.com/s/article/9239477 · Note