|
| |
|
Security Intelligence Operations
Microsoft Windows Kernel Child Window Creation Privilege Escalation Vulnerability |
| |
| Vulnerability Alert | Powered by  |
|
|
| Threat Type: | Unauthorized Access: Privilege Escalation |
|
| IntelliShield ID: | 16799 |
| Version: | 1 |
| First Published: | October 14, 2008 02:20 PM EDT |
| Last Published: | October 14, 2008 02:20 PM EDT |
| Vector: | Local |
| Authentication: | Single |
| Exploit: | Unproven |
| Port: |
Not Available
|
| CVE: | CVE-2008-2250 |
| BugTraq ID: | 31651 |
| |
| Urgency: |
Unlikely Use
|  |
| Credibility: |
Confirmed
|  |
| Severity: |
Moderate Damage
|  |
| CVSS Base: | 6.8 |
CVSS Calculator
CVSS Version 2
|
| CVSS Temporal: | 5.0 |
|
|
| |
| Version Summary: | Microsoft Windows contains a vulnerability that could allow a local attacker to gain escalated privileges on the affected system. Updates are available. |
| |
| |
| Description |
|
Microsoft Windows contains a vulnerability that could allow a local attacker to gain escalated privileges on the affected system.
This vulnerability exists due to insufficient validation of information that is passed from parent windows to child windows during window creation. A local attacker could exploit this vulnerability by running a custom application on the affected system. If successful, the attacker could gain escalated privileges.
Microsoft has confirmed this vulnerability in a security bulletin and released software updates. |
| |
| Warning Indicators |
|
The following versions of Windows are vulnerable:
- Windows 2000 SP4 and prior
- Windows XP SP3 and prior
- Windows XP Professional x64 Edition SP2 and prior
- Windows Server 2003 SP2 and prior
- Windows Server 2003 x64 Edition SP2 and prior
- Windows Server 2003 with SP2 for Itanium-based Systems and prior
- Windows Vista SP1 and prior
- Windows Vista x64 Edition SP1 and prior
- Windows Server 2008 for 32-bit Systems
- Windows Server 2008 for x64-based Systems
- Windows Server 2008 for Itanium-based Systems
|
| |
| IntelliShield Analysis |
|
An attacker must log in locally to an affected system to exploit this vulnerability. An exploit could allow the attacker to gain privileges that are equivalent to the Administrator account. This type of exploit may only be relevant on systems that restrict user privileges as a security measure. An exploit would not allow the attacker to gain any additional privileges on systems that grant users Administrator privileges.
The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008
The update available from Microsoft corrects this vulnerability by validating information exchanged during window creation. |
| |
| Vendor Announcements |
|
Microsoft has released a security bulletin at the following link: MS08-061 |
|
| |
| Impact |
|
A local attacker could exploit this vulnerability to gain elevated privileges on the affected system. An exploit may result in a complete system compromise. |
| |
| Technical Information |
|
To exploit this vulnerability, an attacker will require local account access. No further authentication is required.
This vulnerability exists due to insufficient validation of information that is passed from parent to child windows during creation. A local attacker could leverage this flaw by passing malicious input to a new child process. If successful, the attacker could allow the child process, under the control of the attacker, to gain escalated privileges, allowing the attacker to completely compromise the targeted system. |
| |
| Safeguards |
|
Administrators are advised to apply the appropriate updates.
Administrators are advised to restrict access to affected systems.
Administrators are advised to monitor systems for signs of exploitation. |
| |
| Patches/Software |
|
Microsoft has released updated software at the following links:
|
|
| |
| Alert History |
| |
Initial Release |
|
Product Sets |
| |
The security vulnerability applies to the following combinations of products.
|
|
LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME. |
|
|
| |
