BID:11914

Microsoft Windows LSASS Connection Validation Privilege Escalation Vulnerability

Info

Microsoft Windows LSASS Connection Validation Privilege Escalation Vulnerability

Bugtraq ID:	11914
Class:	Origin Validation Error
CVE:	CVE-2004-0894
Remote:	No
Local:	Yes
Published:	Dec 14 2004 12:00AM
Updated:	Jul 12 2009 09:26AM
Credit:	Discovery is credited to Cesar Cerrudo of Application Security Inc.
Vulnerable:	Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows LSASS Connection Validation Privilege Escalation Vulnerability

Microsoft Windows is prone to a local privilege escalation vulnerability through LSASS (Local Security Authority Subsystem Service). The vulnerability appears to be due to an error in the implementation of an enhanced access control feature. Attackers can exploit this vulnerability to overwrite system files that they do not have access to.

Successful exploitation could result in a local user gaining SYSTEM level access on the computer.

Exploit / POC

Microsoft Windows LSASS Connection Validation Privilege Escalation Vulnerability

Exploit code has been published:

/data/vulnerabilities/exploits/cc-imp-token.c

Solution / Fix

Microsoft Windows LSASS Connection Validation Privilege Escalation Vulnerability

Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.

Microsoft Windows XP Media Center Edition SP2