SecurityFocus

Multiple WinXP kernel vulns can give user mode programs kernel mode privileges Feb 18 2004 10:15PM
first last (randnut hotmail com) (2 replies)

RE: Multiple WinXP kernel vulns can give user mode programs kernel mode privileges Feb 19 2004 02:01PM
Alun Jones (alun texis com)

Re: Multiple WinXP kernel vulns can give user mode programs kernel mode privileges Feb 19 2004 11:09AM
3APA3A (3APA3A SECURITY NNOV RU)

Dear first last,

--Thursday, February 19, 2004, 1:15:20 AM, you wrote to full-disclosure (at) lists.netsys (dot) com [email concealed]:

fl> There exist several vulnerabilities in one of Windows XP kernel's native API
fl> functions which allow any user with the SeDebugPrivilege privilege to
fl> execute arbitrary code in kernel mode, and read from and write to any memory
fl> address, including kernel memory.

SeDebugPrivilege allows you to change execution flow for any process or
kill any process (for example security subsystem or any RPC server).
This privilege is enough to compromise system in thousand ways by
design. By default only Administrators have this privilege.

--
~/ZARAZA
Ýëåêòðè÷åñêèå øîêè î÷åíü ïîëåçíû äëÿ ôîðìèðîâàíèÿ õàðàêòåðà. (Ëåì)

[ reply ]