CVE-2010-4398

Опубликовано: 06 дек. 2010

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Средний

Описание

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Ссылки

http://isc.sans.edu/diary.html?storyid=9988
Exploit
Issue Tracking
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/
Broken Link
http://secunia.com/advisories/42356
Broken Link
Vendor Advisory
http://support.avaya.com/css/P8/documents/100127248
Third Party Advisory
http://twitter.com/msftsecresponse/statuses/7590788200402945
Not Applicable
http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/15609/
Exploit
Third Party Advisory
VDB Entry
http://www.kb.cert.org/vuls/id/529673
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/45045
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1025046
Broken Link
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2011/0324
Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162
Broken Link
http://isc.sans.edu/diary.html?storyid=9988
Exploit
Issue Tracking
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/
Broken Link
http://secunia.com/advisories/42356
Broken Link
Vendor Advisory
http://support.avaya.com/css/P8/documents/100127248
Third Party Advisory
http://twitter.com/msftsecresponse/statuses/7590788200402945
Not Applicable
http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/15609/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.14398

Средний

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-v6fx-3qcr-2mfg