[security-alerts] FW: [SA21417] Microsoft Windows Two Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> TITLE:
> Microsoft Windows Two Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA21417
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/21417/
> 
> CRITICAL:
> Highly critical
> 
> IMPACT:
> Privilege escalation, System access
> 
> WHERE:
> From remote
> 
> OPERATING SYSTEM:
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> 
> DESCRIPTION:
> Two vulnerabilities have been reported in Microsoft Windows, which
> can be exploited by malicious, local users to gain escalated
> privileges and by malicious people to compromise a vulnerable
> system.
> 
> 1) An error in Winlogon when searching for DLL files when
> applications are started can be exploited by a malicious, local user
> to gain escalated privileges by placing a malicious DLL file in the
> user directory.
> 
> NOTE: Only Windows 2000 is affected by default as other OS versions
> have "SafeDllSearchMode" set to "1" by default.
> 
> 2) An error in the exception handling management when multiple
> applications are resident in memory can be exploited to execute
> arbitrary code by tricking a user into visiting a malicious website.
> 
> SOLUTION:
> Apply patches.
> 
> Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=83e0c
> 6fb-a542-463a-88fd-dc388605a8ae
> 
> Windows XP SP1/SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=71e96
> afc-bc4d-4666-998b-49857007e539
> 
> Windows XP Professional x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=a6fe5
> b95-11d1-42cd-995c-c8cef8a27aef
> 
> Windows Server 2003 (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=7d0f8
> 88b-df35-40df-baff-0bae2b921aef
> 
> Windows Server 2003 for Itanium-based systems (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=df365
> b0b-f97f-4df1-9105-d81b68a110eb
> 
> Windows Server 2003 x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=3f750
> ad5-5bfb-4421-a316-ae66f0557eac
> 
> PROVIDED AND/OR DISCOVERED BY:
> 1) The vendor credits Reed Arvin, Canaudit Inc.
> 2) The vendor credits Matt Miller, Leviathan Security Group working
> with Ken Johnson.
> 
> ORIGINAL ADVISORY:
> MS06-051 (KB917422):
> http://www.microsoft.com/technet/security/Bulletin/MS06-051.mspx
>