Executive Summary
| Summary | |
|---|---|
| Title | Vulnerabilities in Windows Kernel |
| Informations | |||
|---|---|---|---|
| Name | MS11-012 | First vendor Publication | 2011-02-08 |
| Vendor | Microsoft | Last vendor Modification | 2011-03-18 |
| Severity (Vendor) | Important | Revision | 2.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V2.0 (March 18, 2011): Clarified the Affected Software to include Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1, and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1. See the entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update, that explains this revision.Summary: This security update resolves five privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logged on locally and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities. The vulnerabilities could not be exploited remotely or by anonymous users. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS11-012.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11638 | |||
| Oval ID: | oval:org.mitre.oval:def:11638 | ||
| Title: | Win32k Window Class Improper Pointer Validation Vulnerability | ||
| Description: | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Window Class Improper Pointer Validation Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0089 | Version: | 10 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12070 | |||
| Oval ID: | oval:org.mitre.oval:def:12070 | ||
| Title: | Win32k Improper User Input Validation Vulnerability | ||
| Description: | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Improper User Input Validation Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0086 | Version: | 10 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12312 | |||
| Oval ID: | oval:org.mitre.oval:def:12312 | ||
| Title: | Win32k Insufficient User Input Validation Vulnerability | ||
| Description: | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Insufficient User Input Validation Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0087 | Version: | 6 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12455 | |||
| Oval ID: | oval:org.mitre.oval:def:12455 | ||
| Title: | Win32k Memory Corruption Vulnerability | ||
| Description: | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0090 | Version: | 10 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12553 | |||
| Oval ID: | oval:org.mitre.oval:def:12553 | ||
| Title: | Win32k Window Class Pointer Confusion Vulnerability | ||
| Description: | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Window Class Pointer Confusion Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0088 | Version: | 10 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-02-09 | Name : Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities (2479628) File : nvt/secpod_ms11-012.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 70819 | Microsoft Windows Kernel Unspecified User Input Validation Weakness Local Pri... Microsoft Windows contains a flaw related to insufficient user input validation that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the kernel-mode drivers validate data supplied from user mode to kernel mode, allowing a local authenticated attacker to gain administrative privileges. |
| 70818 | Microsoft Windows Kernel Unspecified User Input Validation Weakness Local Pri... Microsoft Windows contains a flaw related to improper user input validation that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the kernel-mode drivers validate data supplied from user mode to kernel mode, allowing a local authenticated attacker to gain administrative privileges. |
| 70817 | Microsoft Windows Kernel Class Improper Pointer Validation Unspecified Local ... Microsoft Windows contains a flaw related to class improper point validation that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the kernel-mode drivers validate data supplied from user mode to kernel mode, allowing a local authenticated attacker to gain administrative privileges. |
| 70816 | Microsoft Windows Kernel Window Class Pointer Confusion Unspecified Local Pri... Microsoft Windows contains a flaw related to class pointer confusion that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the kernel-mode drivers validate data supplied from user mode to kernel mode, allowing a local authenticated attacker to gain administrative privileges. |
| 70814 | Microsoft Windows Kernel Unspecified Memory Corruption Local Privilege Escala... Microsoft Windows contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the kernel-mode drivers validate data supplied from user mode to kernel mode, allowing a local authenticated attacker to gain administrative privileges. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows WMI tracing api integer truncation attempt RuleID : 18413 - Revision : 16 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows win32k!xxxTrackPopupMenuEx privilege escalation attempt RuleID : 18412 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows win32k!xxxTrackPopupMenuEx privilege escalation attempt RuleID : 18411 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows win32k.sys write message to dead thread code execution attempt RuleID : 18410 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows win32k.sys write message to dead thread code execution attempt RuleID : 18409 - Revision : 9 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-02-08 | Name : The remote Windows kernel is affected by multiple vulnerabilities. File : smb_nt_ms11-012.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:52 |
|
| 2014-01-19 21:30:36 |
|
