Security Intelligence Operations

Microsoft Windows contains a vulnerability that could allow a local attacker to gain elevated privileges on the affected system.

This vulnerability exists due to errors in memory operations.  A local attacker could exploit this vulnerability by running a malicious application.  An exploit could allow the attacker to gain elevated privileges on the affected system.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates that correct it.

Systems running the following versions of Microsoft Windows are vulnerable:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 with SP2 for Itanium-based Systems and prior
• Windows Vista SP1 and prior
• Windows Vista x64 Edition SP1 and prior
• Windows Server 2008 for 32-bit Systems
• Windows Server 2008 for x64-based Systems
• Windows Server 2008 for Itanium-based Systems

An attacker must log in locally to an affected system to exploit this vulnerability.  If an exploit is successful, the attacker could gain elevated privileges equivalent to the Administrator account.  The attacker could use these privileges to gain complete control over the affected system.  A successful exploit against this vulnerability on systems that grant users Administrator privileges would not grant an attacker any additional privileges beyond those already granted with local account access.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008

The update available from Microsoft corrects this vulnerability by preventing the freeing of previously freed memory areas.

Microsoft has released a security bulletin at the following link: MS08-061