Microsoft Windows WINS Server Local Privilege Escalation Vulnerability

Bugtraq ID:	29588
Class:	Boundary Condition Error
CVE:	CVE-2008-1451
Remote:	No
Local:	Yes
Published:	Jun 10 2008 12:00AM
Updated:	Jun 23 2008 02:31PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Nortel Networks Centrex IP Client Manager 9.0 Nortel Networks Centrex IP Client Manager 11.0 Nortel Networks Centrex IP Client Manager 10.0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Windows WINS Server Local Privilege Escalation Vulnerability

Microsoft Windows WINS server is prone to a local privilege-escalation vulnerability that may be triggered by malicious WINS network packets.

Successful exploits allow local attackers to execute arbitrary code with SYSTEM-level privileges, completely compromising the affected computer.

Microsoft Windows WINS Server Local Privilege Escalation Vulnerability

The following exploits for Immunity CANVAS are available:

https://www.immunityinc.com/downloads/immpartners/ms08_034.tgz
https://www.immunityinc.com/downloads/immpartners/ms08_034-2.tgz
https://www.immunityinc.com/downloads/immpartners/ms08_034_2003.tar.gz

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Windows WINS Server Local Privilege Escalation Vulnerability

Solution:
Microsoft has released an advisory along with fixes to address this issue. Please see the references for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa8aa79f-c2cc -440c-9e5c-089143e6f814

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa8aa79f-c2cc -440c-9e5c-089143e6f814

Microsoft Windows Server 2003 SP1

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=08fc90d5-23aa -4327-8aef-16bc5170769d

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa8aa79f-c2cc -440c-9e5c-089143e6f814

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=71675ae8-d60a -4834-b358-2d8e761e62fc

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB948745)
  http://www.microsoft.com/downloads/details.aspx?familyid=87affdc9-d9fe -413c-af30-f3d3b671ec72

Microsoft Windows WINS Server Local Privilege Escalation Vulnerability

References:

• Microsoft Windows Homepage (Microsoft)
  
• ASA-2008-239 MS08-034 Vulnerability in WINS Could Allow Elevation of Privilege ( (Avaya)
  
• Centrex IP Client Manager (CICM) response to Microsoft June security bulletin (Nortel Networks)
  
• Microsoft Security Bulletin MS08-034 (Microsoft)