[security-alerts] FW: [SA24834] Microsoft Windows Kernel Mapped Memory Insecure Permissions

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Microsoft Windows Kernel Mapped Memory Insecure Permissions
> 
> SECUNIA ADVISORY ID:
> SA24834
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/24834/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Privilege escalation
> 
> WHERE:
> Local system
> 
> OPERATING SYSTEM:
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> 
> DESCRIPTION:
> eEye Digital Security has reported a vulnerability in Microsoft
> Windows, which can be exploited by malicious, local users to gain
> escalated privileges.
> 
> The vulnerability is caused due to a race condition in the kernel's
> Virtual DOS Machine (VDM) implementation. This results in insecure
> permissions on a mapped memory segment thereby allowing manipulation
> of the contents.
> 
> Successful exploitation allows execution of arbitrary code with
> escalated privileges.
> 
> NOTE: This security issue does not affected Windows for x64 and
> Itanium-based systems.
> 
> SOLUTION:
> Apply patches.
> 
> Windows 2000 (requires SP4):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=b3599
> afb-7673-4ef6-a2b1-d77e39fd782c
> 
> Windows XP (requires SP2):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=eeaee
> 4a7-4858-4b6b-9c6d-a9f1eae19b51
> 
> Windows Server 2003 (optionally with SP1/SP2):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=5e94a
> 29c-7ec0-4459-92eb-d43b524fd6fd
> 
> PROVIDED AND/OR DISCOVERED BY:
> Derek Soeder, eEye Digital Security.
> 
> ORIGINAL ADVISORY:
> MS07-022 (KB931784):
> http://www.microsoft.com/technet/security/Bulletin/MS07-022.mspx
> 
> eEye Digital Security:
> http://research.eeye.com/html/advisories/published/AD20070410a.html
> 
>