| VID |
26627 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The Hotfix (MS12-041, 2709162) for 'Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege' has not been applied.
This security update resolves five privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit any of these vulnerabilities.
- String Atom Class Name Handling Vulnerability (CVE-2012-1864)
An elevation of privilege vulnerability exists because of the way that Windows kernel-mode drivers manage kernel-mode driver objects. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- String Atom Class Name Handling Vulnerability (CVE-2012-1865)
An elevation of privilege vulnerability exists because of the way that Windows kernel-mode drivers manage kernel-mode driver objects. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Clipboard Format Atom Name Handling Vulnerability (CVE-2012-1866)
An elevation of privilege vulnerability exists because of the way that Windows kernel-mode drivers manage kernel-mode driver objects. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Font Resource Refcount Integer Overflow Vulnerability (CVE-2012-1867)
An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly allocate memory when handling fonts. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Win32k.sys Race Condition Vulnerability (CVE-2012-1868)
An elevation of privilege vulnerability exists in the Windows kernel because of the way that the kernel deals with specific thread creation attempts. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://technet.microsoft.com/en-us/security/bulletin/ms12-041
* Platforms Affected:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 |
| Recommendation |
Apply the appropriate patch (2709162)for your system, as listed in Microsoft Security Bulletin MS12-041 at http://technet.microsoft.com/en-us/security/bulletin/MS12-041
-- OR --
Patches for Windows platforms are also available from the Microsoft Windows Update Web site, http://windowsupdate.microsoft.com. Windows Update detects what version of Windows you are running and offers the appropriate patch. |
| Related URL |
CVE-2012-1864,CVE-2012-1865,CVE-2012-1866,CVE-2012-1867,CVE-2012-1868 (CVE) |
| Related URL |
53815,53816,53817,53819,53820 (SecurityFocus) |
| Related URL |
(ISS) |
|
