Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnerability

Bugtraq ID:	26757
Class:	Unknown
CVE:	CVE-2007-5350
Remote:	No
Local:	Yes
Published:	Dec 11 2007 12:00AM
Updated:	Mar 07 2008 05:42PM
Credit:	Discovery is credited to Thomas Garnier of SkyRecon.
Vulnerable:	Microsoft Windows Vista Ultimate 64-bit edition 0 Microsoft Windows Vista Home Premium 64-bit edition 0 Microsoft Windows Vista Home Basic 64-bit edition 0 Microsoft Windows Vista Enterprise 64-bit edition 0 Microsoft Windows Vista Business 64-bit edition 0 Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise Microsoft Windows Vista Business Microsoft Windows Vista 0 HP Storage Management Appliance III HP Storage Management Appliance II HP Storage Management Appliance I HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I
Not Vulnerable:

Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnerability

Microsoft Windows Vista is prone to a local privilege-escalation vulnerability.

The vulnerability resides in the Windows Kernel. A locally logged-in user can exploit this issue to gain kernel-level access to the operating system.

Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnerability

The following exploit is available to members of the Immunity Partner's Program:

https://www.immunityinc.com/downloads/immpartners/ms07-066.tgz

Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnerability

Solution:
Microsoft has released a security bulletin and updates to address this vulnerability.


Microsoft Windows Vista Home Basic 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB943078)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5f382050-8df6 -43aa-82e9-8fad5ff8ecec&displaylang=en

Microsoft Windows Vista Ultimate

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Enterprise 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB943078)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5f382050-8df6 -43aa-82e9-8fad5ff8ecec&displaylang=en

Microsoft Windows Vista Home Premium 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB943078)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5f382050-8df6 -43aa-82e9-8fad5ff8ecec&displaylang=en

Microsoft Windows Vista 0

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Business

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Ultimate 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB943078)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5f382050-8df6 -43aa-82e9-8fad5ff8ecec&displaylang=en

Microsoft Windows Vista Home Basic

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Business 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB943078)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5f382050-8df6 -43aa-82e9-8fad5ff8ecec&displaylang=en

Microsoft Windows Vista Home Premium

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Enterprise

• Microsoft Security Update for Windows Vista (KB943078)
  http://www.microsoft.com/downloads/details.aspx?familyid=9787619f-1297 -411e-8b9c-3ad3e6a99797&displaylang=en

Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnerability

References:

• Microsoft Security Bulletin MS07-066 (Microsoft)
  
• Vulnerability Note VU#601073 Microsoft Windows Vista privilege escalation vulner (US-CERT)