Microsoft Windows Korean Input Method Editor Privilege Escalation Vulnerability

Bugtraq ID:	16643
Class:	Design Error
CVE:	CVE-2006-0008
Remote:	No
Local:	Yes
Published:	Feb 14 2006 12:00AM
Updated:	Mar 11 2006 05:50AM
Credit:	Discovered by Ryan Lee.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003
Not Vulnerable:	Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional

Microsoft Windows Korean Input Method Editor Privilege Escalation Vulnerability


Microsoft Windows Korean Input Method Editor is prone to a local privilege-escalation vulnerability.

Successful exploitation can allow local attackers to completely compromise a vulnerable computer.

Microsoft Windows Korean Input Method Editor Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Microsoft Windows Korean Input Method Editor Privilege Escalation Vulnerability

Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server x64 Edition (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=66E495E8-CD52 -4E76-B20A-4471FA941556&displaylang=en

Microsoft Windows XP Media Center Edition SP1

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Office 2003 SP2

• Microsoft Security Update for Office 2003 (KB905645)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office OneNote 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office Project 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office Visio 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 Multilingual User Interface Pack (KB905645)
  Fix for Microsoft Office 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=986F9A8D-AFE7 -455A-B78D-0795CBB0E80E&displaylang=en


• Microsoft Security Update for Office 2003 Proofing Tools (KB905645)
  Fix for Microsoft Office 2003 Proofing Tools.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=32CF9F59-FFBD -45E5-A4D2-690183462D0F&displaylang=en


• Microsoft Security Update for Project 2003 Multilingual User Interface Pack (KB909118)
  Fix for Microsoft Office Project 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=22C96D7F-F384 -4678-9AC0-3A11B81A4C1D&displaylang=en


• Microsoft Security Update for Visio 2003 Multilingual User Interface Pack (KB909115)
  Fix for Microsoft Office Visio 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5A4D0A92-2DFC -4F8B-9D14-138CEA57AF96&displaylang=en

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=7D75BF5C-2E1D -4793-B7D1-DD372A99ECA5&displaylang=en

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB901190) - English
  http://www.microsoft.com/downloads/details.aspx?familyid=8479C2EB-0FB6 -4879-9C3D-B49BD864A71C&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB901190) - English
  http://www.microsoft.com/downloads/details.aspx?familyid=8479C2EB-0FB6 -4879-9C3D-B49BD864A71C&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB901190) - English
  http://www.microsoft.com/downloads/details.aspx?familyid=8479C2EB-0FB6 -4879-9C3D-B49BD864A71C&displaylang=en

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server x64 Edition (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=66E495E8-CD52 -4E76-B20A-4471FA941556&displaylang=en

Microsoft Windows XP Tablet PC Edition SP1

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Windows Server 2003 (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=A092BA0F-C753 -444B-A572-492E4ECB2D3F&displaylang=en

Microsoft Office 2003 SP1

• Microsoft Security Update for Office 2003 (KB905645)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office OneNote 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office Project 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 (KB905645)
  Fix for Microsoft Office Visio 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8E6F16E9-CD73 -47D5-887E-616DB9B09591&displaylang=en


• Microsoft Security Update for Office 2003 Multilingual User Interface Pack (KB905645)
  Fix for Microsoft Office 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=986F9A8D-AFE7 -455A-B78D-0795CBB0E80E&displaylang=en


• Microsoft Security Update for Office 2003 Proofing Tools (KB905645)
  Fix for Microsoft Office 2003 Proofing Tools.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=32CF9F59-FFBD -45E5-A4D2-690183462D0F&displaylang=en


• Microsoft Security Update for Project 2003 Multilingual User Interface Pack (KB909118)
  Fix for Microsoft Office Project 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=22C96D7F-F384 -4678-9AC0-3A11B81A4C1D&displaylang=en


• Microsoft Security Update for Visio 2003 Multilingual User Interface Pack (KB909115)
  Fix for Microsoft Office Visio 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5A4D0A92-2DFC -4F8B-9D14-138CEA57AF96&displaylang=en

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server x64 Edition (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=66E495E8-CD52 -4E76-B20A-4471FA941556&displaylang=en

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB901190)
  http://www.microsoft.com/downloads/details.aspx?familyid=290453DF-1CAE -4691-B20C-5D65D92216BF&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB901190) - English
  http://www.microsoft.com/downloads/details.aspx?familyid=8479C2EB-0FB6 -4879-9C3D-B49BD864A71C&displaylang=en

Microsoft Windows Korean Input Method Editor Privilege Escalation Vulnerability

References:

• Microsoft Security Bulletin MS06-009 (Microsoft)
  
• Misuse of ShellAbout() API could allow elevation of privilege (VMCraft)