[NT] Windows Kernel Elevation of Privilege (MS07-022)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Windows Kernel Elevation of Privilege (MS07-022)
------------------------------------------------------------------------


SUMMARY

A privilege elevation vulnerability exists in Windows Kernel because of
incorrect permissions on a mapped memory segment. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system.

DETAILS

Affected Software:
* Microsoft Windows 2000 Service Pack 4 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=b3599afb-7673-4ef6-a2b1-d77e39fd782c> Download the update
* Microsoft Windows XP Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=eeaee4a7-4858-4b6b-9c6d-a9f1eae19b51> Download the update
* Microsoft Windows Server 2003, Microsoft Windows Server 2003 Service
Pack 1, and Microsoft 2003 Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=5e94a29c-7ec0-4459-92eb-d43b524fd6fd> Download the update

Non-Affected Software:
* Microsoft Windows XP Professional x64 Edition and Microsoft Windows XP
Professional x64 Edition Service Pack 2
* Microsoft Windows Server 2003 x64 Edition and Microsoft Windows Server
2003 x64 Edition Service Pack 2
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft
Windows Server 2003 with SP1 and SP2 for Itanium-based Systems
* Windows Vista
* Windows Vista x64 Edition

Kernel Local Elevation of Privilege Vulnerability - CVE-2007-1206:
A privilege elevation vulnerability exists in Windows Kernel because of
incorrect permissions on a mapped memory segment. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system.

Mitigating Factors for Kernel Local Elevation of Privilege Vulnerability -
CVE-2007-1206:
An attacker must have valid logon credentials and be able to log on
locally to exploit this vulnerability. The vulnerability could not be
exploited remotely or by anonymous users.

Workarounds for Kernel Local Elevation of Privilege Vulnerability -
CVE-2007-1206:
We have not identified any workarounds for this vulnerability.

FAQ for Kernel Local Elevation of Privilege Vulnerability - CVE-2007-1206:
What is the scope of the vulnerability?
A privilege elevation vulnerability exists in Windows Kernel because of
incorrect permissions on a mapped memory segment. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system. To attempt to exploit the vulnerability, an attacker
must be able to log on locally to the system.

What causes the vulnerability?
The Windows Kernel allows for incorrect permissions to be used when
mapping a memory segment.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could run
arbitrary code on a user s system with elevated privileges. This could
allow an attacker to take complete control of the affected system.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to
the system. An attacker could then run a specially crafted application
that could exploit the vulnerability and gain complete control over the
affected system.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be
at more risk if administrators allow users to log on to servers and to run
programs. However, best practices strongly discourage allowing this.

Could the vulnerability be exploited over the Internet?
No. An attacker must be able to log on to the specific system that is
targeted for attack. An attacker cannot load and run a program remotely by
using this vulnerability.

What does the update do?
The update removes the vulnerability by modifying the way that the Windows
Kernel validates permissions during memory mapping.

When this security bulletin was issued, had this vulnerability been
publicly disclosed?
No. Microsoft received information about this vulnerability through
responsible disclosure. Microsoft had not received any information to
indicate that this vulnerability had been publicly disclosed when this
security bulletin was originally issued.

When this security bulletin was issued, had Microsoft received any reports
that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers and had not seen
any examples of proof of concept code published when this security
bulletin was originally issued.


ADDITIONAL INFORMATION

The information has been provided by Microsoft Security Bulletin MS07-022.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms07-022.mspx>
http://www.microsoft.com/technet/security/bulletin/ms07-022.mspx



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages