BID:10710

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

Info

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

Bugtraq ID:	10710
Class:	Boundary Condition Error
CVE:	CVE-2004-0210
Remote:	No
Local:	Yes
Published:	Jul 13 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery of this vulnerability is credited to Rafal Wojtczuk of Network Associates.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT 4.0 SP6 alpha Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Interix 2.2 Avaya S3400 Message Application Server 0 + Microsoft Windows 2000 Server

Not Vulnerable:

Discussion

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

The Microsoft POSIX subsystem implementation is prone to a local buffer overflow vulnerability.

A local attacker may exploit this vulnerability in order to run code with elevated privileges, fully compromising the vulnerable computer.

Exploit / POC

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.

An exploit to leverage this vulnerability has been made available by bkbll <[email protected]>. It is reported that this exploit has been tested on Microsoft Windows 2000 Service Pack 4 platforms.

/data/vulnerabilities/exploits/Posixexp.c

Solution / Fix

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

Solution:
Microsoft has released an updated security bulletin (MS04-020) and fixes to address this issue for supported operating systems.

Avaya has released an advisory that acknowledges this vulnerability for Avaya products. Avaya advise that customers follow the Microsoft recommendations to address this issue. Please see the referenced Avaya advisory at the following location for further details:
http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=197331&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()

Microsoft Windows 2000 Server SP2