Microsoft Windows AFD Driver CVE-2011-2005 Local Privilege Escalation Vulnerability

Bugtraq ID:	49941
Class:	Input Validation Error
CVE:	CVE-2011-2005
Remote:	No
Local:	Yes
Published:	Oct 11 2011 12:00AM
Updated:	Oct 03 2012 06:10AM
Credit:	Bo Zhou of National University of Defense Technology
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0
Not Vulnerable:

Microsoft Windows AFD Driver CVE-2011-2005 Local Privilege Escalation Vulnerability

Microsoft Windows is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.

Microsoft Windows AFD Driver CVE-2011-2005 Local Privilege Escalation Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/49941.py
• /data/vulnerabilities/exploits/49941.rb

Microsoft Windows AFD Driver CVE-2011-2005 Local Privilege Escalation Vulnerability

Solution:
Vendor updates are available. Please see the references for details.


Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=29228167-b811 -43d7-b4a0-91e385b598a5

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=29228167-b811 -43d7-b4a0-91e385b598a5

Microsoft Windows XP Media Center Edition SP3

• Microsoft Security Update for Windows XP (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=f1b2dceb-5bef -4522-9001-8dff0545d805

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=42465652-2664 -4fd5-9a22-ae847b08e7c8

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=29228167-b811 -43d7-b4a0-91e385b598a5

Microsoft Windows XP Home SP3

• Microsoft Security Update for Windows XP (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=f1b2dceb-5bef -4522-9001-8dff0545d805

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=9a37864e-8543 -4c52-aa73-e3c190860d76

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=0816d729-6769 -4ca6-a14e-71750eca8d29

Microsoft Windows XP Tablet PC Edition SP3

• Microsoft Security Update for Windows XP (KB2592799)
  http://www.microsoft.com/downloads/details.aspx?familyid=f1b2dceb-5bef -4522-9001-8dff0545d805

Microsoft Windows AFD Driver CVE-2011-2005 Local Privilege Escalation Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• ASA-2011-310 MS11-080 Vulnerability in Ancillary Function Driver Could Allow Ele (Avaya)
  
• Microsoft Security Bulletin MS11-080 (Microsoft)