Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
BID:11913
Info
Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
| Bugtraq ID: | 11913 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0893 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 14 2004 12:00AM |
| Updated: | Jul 12 2009 09:26AM |
| Credit: | Discovery is credited to Cesar Cerrudo of Application Security Inc. |
| Vulnerable: |
Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6a Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server |
| Not Vulnerable: | |
Discussion
Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
Microsoft Windows is prone to a locally exploitable privilege escalation vulnerability. This is reportedly due to an unchecked buffer that is exposed through the LPC (Local Procedure Call) interface in the Windows kernel.
Successful exploitation would permit a local attacker to compromise the vulnerable computer.
The vendor has stated that this issue may likely only result in a denial of service on Windows XP SP2 and Windows Server 2003 platforms. This may be due to buffer overflow protection features included in these platforms. It is possible that a skilled attacker could bypass these security measures.
It is noted that the vulnerability is present in an API, so any applications or libraries that rely on the API may be exposed to this issue.
Microsoft Windows is prone to a locally exploitable privilege escalation vulnerability. This is reportedly due to an unchecked buffer that is exposed through the LPC (Local Procedure Call) interface in the Windows kernel.
Successful exploitation would permit a local attacker to compromise the vulnerable computer.
The vendor has stated that this issue may likely only result in a denial of service on Windows XP SP2 and Windows Server 2003 platforms. This may be due to buffer overflow protection features included in these platforms. It is possible that a skilled attacker could bypass these security measures.
It is noted that the vulnerability is present in an API, so any applications or libraries that rely on the API may be exposed to this issue.
Exploit / POC
Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows NT Server 4.0 SP6a
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows NT Terminal Server 4.0 SP6a
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows XP Home SP2
Microsoft Windows Server 2003 Web Edition
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows XP Home SP1
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP Professional SP2
Microsoft Windows NT Enterprise Server 4.0 SP6a
Microsoft Windows 2000 Professional SP4
Microsoft Windows XP Professional SP1
Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.
Microsoft Windows XP Media Center Edition SP2
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
Microsoft Windows NT Server 4.0 SP6a
-
Microsoft Security Update for Windows NT Server 4.0 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=325EAA8F-AF09 -4839-B9E8-BB218C7A8564
Microsoft Windows XP Media Center Edition SP1
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
Microsoft Windows NT Terminal Server 4.0 SP6a
-
Microsoft Security Update for Windows NT Server 4.0, Terminal Server Edition (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=9823A61F-C69F -403A-BD6A-EF3984BFA2B8
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
-
Microsoft !!Security Update for Windows Server 2003 64-bit Edition and Windows XP 64-bit Edition, Version 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=95849AB9-36BF -4A90-BC37-3B4FB6DCDF9A -
Microsoft Security Update for Windows Server 2003 64-bit/Windows XP 64-bit, 2003 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=95849AB9-36BF -4A90-BC37-3B4FB6DCDF9A
Microsoft Windows NT Terminal Server 4.0 SP6
-
Microsoft Security Update for Windows NT Server 4.0, Terminal Server Edition (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=9823A61F-C69F -403A-BD6A-EF3984BFA2B8
Microsoft Windows Server 2003 Standard Edition
-
Microsoft Security Update for Windows Server 2003 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=AACB97CB-E8F0 -461F-B2D2-F1065229B64E
Microsoft Windows XP 64-bit Edition SP1
-
Microsoft Security Update for Windows XP 64-bit Edition (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=1649AE1E-0ABF -4D31-BE12-3982C5146AE8
Microsoft Windows 2000 Advanced Server SP4
-
Microsoft Security Update for Windows 2000 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=EFDEA122-DDA4 -40B8-A7AF-9DDCC3870C38
Microsoft Windows 2000 Professional SP3
-
Microsoft Security Update for Windows 2000 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=EFDEA122-DDA4 -40B8-A7AF-9DDCC3870C38
Microsoft Windows Server 2003 Enterprise Edition
-
Microsoft Security Update for Windows Server 2003 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=AACB97CB-E8F0 -461F-B2D2-F1065229B64E
Microsoft Windows XP Home SP2
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
Microsoft Windows Server 2003 Web Edition
-
Microsoft Security Update for Windows Server 2003 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=AACB97CB-E8F0 -461F-B2D2-F1065229B64E
Microsoft Windows 2000 Advanced Server SP3
-
Microsoft Security Update for Windows 2000 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=EFDEA122-DDA4 -40B8-A7AF-9DDCC3870C38
Microsoft Windows XP Home SP1
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
Microsoft Windows XP 64-bit Edition Version 2003 SP1
-
Microsoft Security Update for Windows Server 2003 64-bit/Windows XP 64-bit, 2003 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=95849AB9-36BF -4A90-BC37-3B4FB6DCDF9A
Microsoft Windows XP Professional SP2
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
Microsoft Windows NT Enterprise Server 4.0 SP6a
-
Microsoft Security Update for Windows NT Server 4.0 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=325EAA8F-AF09 -4839-B9E8-BB218C7A8564
Microsoft Windows 2000 Professional SP4
-
Microsoft Security Update for Windows 2000 (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=EFDEA122-DDA4 -40B8-A7AF-9DDCC3870C38
Microsoft Windows XP Professional SP1
-
Microsoft Security Update for Windows XP (KB885835)
http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A -4F41-B81E-376AA1CD204F
References
Microsoft Windows Kernel Unchecked LPC Buffer Privilege Escalation Vulnerability
References:
References:
- [VulnWatch] [AppSecInc Team SHATTER Security Advisory] Microsoft Windows LPC hea (Team SHATTER (Application Security, Inc.) (vrathodappsecinc.com))
- Microsoft Security Bulletin MS04-044 (Microsoft)