|
|
|
|
| |
Credit:
The information has been provided by Microsoft Product Security.
The original article can be found at: http://www.microsoft.com/technet/security/Bulletin/MS06-049.mspx
|
| |
Affected Software:
* Microsoft Windows 2000 Service Pack 4 - Download the update
Non-Affected Software:
* Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition
Mitigating Factors for Windows 2000 Kernel Elevation of Privilege Vulnerability - CVE-2006-3444:
* An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.
Workarounds for Windows 2000 Kernel Elevation of Privilege Vulnerability - CVE-2006-3444:
We have not identified any workarounds for this vulnerability
FAQ for Windows 2000 Kernel Elevation of Privilege Vulnerability - CVE-2006-3444:
What is the scope of the vulnerability?
This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To attempt to exploit the vulnerability, an attacker must be able to log on locally to the system and run a program.
What causes the vulnerability?
An unchecked buffer in the Windows 2000 Kernel.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.
Who could exploit the vulnerability?
To try to exploit the vulnerability, an attacker must be able to log on locally to a system and run a program.
How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker would then have to execute a program that could exploit the vulnerability and gain complete control over the affected system.
What systems are primarily at risk from the vulnerability?
Windows 2000 systems are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.
Could the vulnerability be exploited over the Internet?
No. An attacker must be able to log on to the specific system that is targeted for attack. An attacker cannot load and run a program remotely by using this vulnerability.
What does the update do?
The update removes the vulnerability by correctly validating an input buffer size in the Windows 2000 Kernel.
When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. While the initial report was provided through responsible disclosure, the vulnerability was later disclosed publicly. This security bulletin addresses the publicly disclosed vulnerability as well as additional issues discovered through internal investigations.
When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.
|
|
|
|
|
