Executive Summary

Summary
Title Microsoft Windows RtlQueryRegistryValues() does not adequately validate registry data
Informations
NameVU#529673First vendor Publication2010-11-26
VendorVU-CERTLast vendor Modification2010-11-26
Severity (Vendor) N/ARevisionM

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score7.2Attack RangeLocal
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score3.9AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#529673

Microsoft Windows RtlQueryRegistryValues() does not adequately validate registry data

Overview

Microsoft Windows does not adequately validate registry data read using the function RtlQueryRegistryValues(). By modifying an EUDC registry key value, a local user could execute arbitrary code with SYSTEM privileges.

I. Description

Microsoft Windows supports end-user-defined characters (EUDC) to allow users to define custom unicode characters. The Windows kernel (win32k.sys) graphics device interface (GDI) reads the EUDC registry key for font information. More specifically, GreEnableEudc() uses RtlQueryRegistryValues() to read HKCUEUDC{codepage}SystemDefaultEUDCFont. In this case RtlQueryRegistryValues() expects to read a REG_SZ (string) value into a buffer whose length and contents are determined by the type and value of SystemDefaultEUDCFont.

By default, an unprivileged user has access to modify the EUDC registry key. Furthermore, RtlQueryRegistryValues() does not validate the data read from SystemDefaultEUDCFont.

By changing the type and data of SystemDefaultEUDCFont and enabling EUDC, an attacker can overwrite kernel memory.

Publicly available exploit code targets Windows Vista, Windows 7, and Windows Server 2008 platforms. Windows XP and Windows Server 2003 may also be affected.

II. Impact

An unprivileged local user can execute arbitrary code with SYSTEM privileges.

III. Solution

We are currently unaware of a complete solution to this problem.

Restrict access to EUDC registry key

Change the ACL on the EUDC registry key to prevent modifications. The EUDC key is in user registry hives so it may be necessary to make the change under HKCU and all the HKEY_USERS* subkeys.

Preventing users from changing the types and data in EUDC registry key values will block the specific attack vector described in the initial public disclosure of this vulnerability. There may be other attack vectors in which RtlQueryRegistryValues()is used by the kernel to read registry user-modifiable registry values.

Vendor Information

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected2010-11-26

References

http://secunia.com/advisories/42356
http://www.exploit-db.com/exploits/15609/
http://moonslab.com/1195
http//nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses...
http://isc.sans.edu/diary.html?storyid=9988
http://www.prevx.com/blog/160/New-Windows-day-exploit-speaks-chinese.html
http://msdn.microsoft.com/en-us/library/dd317836%28VS.85%29.aspx

Credit

This vulnerability was publicly disclosed by noobpwnftw.

This document was written by Art Manion.

Other Information

Date Public:2010-11-24
Date First Published:2010-11-26
Date Last Updated:2010-11-26
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:15.94
Document Revision:10

Original Source

Url : http://www.kb.cert.org/vuls/id/529673

CWE : Common Weakness Enumeration

idName
CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12162
 
Oval ID: oval:org.mitre.oval:def:12162
Title: Driver Improper Interaction with Windows Kernel Vulnerability
Description: Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2010-4398
Version: 6
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os1
Os1
Os5
Os1
Os1

OpenVAS Exploits

DateDescription
2011-02-09Name : Microsoft Windows Kernel Elevation of Privilege Vulnerability (2393802)
File : nvt/secpod_ms11-011.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
69501Microsoft Windows win32k.sys Driver GreEnableEUDC() Function Local Overflow

Information Assurance Vulnerability Management (IAVM)

DateDescription
2011-02-10IAVM : 2011-A-0022 - Multiple Vulnerabilities in Microsoft Windows Kernel
Severity : Category I - VMSKEY : V0026065

Nessus® Vulnerability Scanner

DateDescription
2011-02-08Name : The Windows kernel is affected by several vulnerabilities that could allow es...
File : smb_nt_ms11-011.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:07:55
  • Multiple Updates