BID:35601

Microsoft Virtual PC and Virtual Server Privilege Escalation Vulnerability

Info

Microsoft Virtual PC and Virtual Server Privilege Escalation Vulnerability

Bugtraq ID:	35601
Class:	Unknown
CVE:	CVE-2009-1542
Remote:	No
Local:	Yes
Published:	Jul 14 2009 12:00AM
Updated:	Apr 19 2013 02:40AM
Credit:	Julien Tinnes and Tavis Ormandy of Google Inc
Vulnerable:	Microsoft Virtual Server 2005 Standard Edition R2 Microsoft Virtual Server 2005 R2 SP1 x64 Edition 0 Microsoft Virtual Server 2005 R2 SP1 0 Microsoft Virtual Server 2005 Enterprise Edition R2 Microsoft Virtual Server 2005 Enterprise Edition 0 Microsoft Virtual Server 2005 0 Microsoft Virtual PC 2007 x64 Edition SP1 Microsoft Virtual PC 2007 x64 Edition 0 Microsoft Virtual PC 2007 SP1 Microsoft Virtual PC 2007 0 Microsoft Virtual PC 2004 SP1 Microsoft Virtual PC 2004 0

Not Vulnerable:

Discussion

Microsoft Virtual PC and Virtual Server Privilege Escalation Vulnerability

Microsoft Virtual PC and Virtual Server are prone to a privilege-escalation vulnerability caused by an error in decoding privileged instructions.

Note that this issue affects only systems that do not use hardware-assisted virtualization.

Successful exploits may allow local attackers to elevate privileges within a guest operating system.

Exploit / POC

Microsoft Virtual PC and Virtual Server Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft Virtual PC and Virtual Server Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Microsoft Virtual PC 2004 SP1