Executive Summary

Summary
Title Microsoft Windows RtlQueryRegistryValues() does not adequately validate registry data
Informations
Name VU#529673 First vendor Publication 2010-11-26
Vendor VU-CERT Last vendor Modification 2010-11-26
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#529673

Microsoft Windows RtlQueryRegistryValues() does not adequately validate registry data

Overview

Microsoft Windows does not adequately validate registry data read using the function RtlQueryRegistryValues(). By modifying an EUDC registry key value, a local user could execute arbitrary code with SYSTEM privileges.

I. Description

Microsoft Windows supports end-user-defined characters (EUDC) to allow users to define custom unicode characters. The Windows kernel (win32k.sys) graphics device interface (GDI) reads the EUDC registry key for font information. More specifically, GreEnableEudc() uses RtlQueryRegistryValues() to read HKCUEUDC{codepage}SystemDefaultEUDCFont. In this case RtlQueryRegistryValues() expects to read a REG_SZ (string) value into a buffer whose length and contents are determined by the type and value of SystemDefaultEUDCFont.

By default, an unprivileged user has access to modify the EUDC registry key. Furthermore, RtlQueryRegistryValues() does not validate the data read from SystemDefaultEUDCFont.

By changing the type and data of SystemDefaultEUDCFont and enabling EUDC, an attacker can overwrite kernel memory.

Publicly available exploit code targets Windows Vista, Windows 7, and Windows Server 2008 platforms. Windows XP and Windows Server 2003 may also be affected.

II. Impact

An unprivileged local user can execute arbitrary code with SYSTEM privileges.

III. Solution

We are currently unaware of a complete solution to this problem.

Restrict access to EUDC registry key

Change the ACL on the EUDC registry key to prevent modifications. The EUDC key is in user registry hives so it may be necessary to make the change under HKCU and all the HKEY_USERS* subkeys.

Preventing users from changing the types and data in EUDC registry key values will block the specific attack vector described in the initial public disclosure of this vulnerability. There may be other attack vectors in which RtlQueryRegistryValues()is used by the kernel to read registry user-modifiable registry values.

Vendor Information

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected2010-11-26

References

http://secunia.com/advisories/42356
http://www.exploit-db.com/exploits/15609/
http://moonslab.com/1195
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/
http://isc.sans.edu/diary.html?storyid=9988
http://www.prevx.com/blog/160/New-Windows-day-exploit-speaks-chinese.html
http://msdn.microsoft.com/en-us/library/dd317836%28VS.85%29.aspx

Credit

This vulnerability was publicly disclosed by noobpwnftw.

This document was written by Art Manion.

Other Information

Date Public:2010-11-24
Date First Published:2010-11-26
Date Last Updated:2010-11-26
CERT Advisory: 
CVE-ID(s): 
NVD-ID(s): 
US-CERT Technical Alerts: 
Severity Metric:15.94
Document Revision:10

Original Source

Url : http://www.kb.cert.org/vuls/id/529673

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12162
 
Oval ID: oval:org.mitre.oval:def:12162
Title: Driver Improper Interaction with Windows Kernel Vulnerability
Description: Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2010-4398
Version: 6
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 1
Os 1
Os 5
Os 1
Os 1

OpenVAS Exploits

Date Description
2011-02-09 Name : Microsoft Windows Kernel Elevation of Privilege Vulnerability (2393802)
File : nvt/secpod_ms11-011.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
69501 Microsoft Windows win32k.sys Driver GreEnableEUDC() Function Local Overflow

Microsoft Windows is prone to an overflow condition. win32k.sys fails to properly process the 'GreEnableEUDC()' function, resulting in a buffer overflow. With a specially crafted 'SystemDefaultEUDCFont' registry value, a local attacker can potentially execute arbitrary code.

Information Assurance Vulnerability Management (IAVM)

Date Description
2011-02-10 IAVM : 2011-A-0022 - Multiple Vulnerabilities in Microsoft Windows Kernel
Severity : Category I - VMSKEY : V0026065

Snort® IPS/IDS

Date Description
2017-02-21 Microsoft Windows RtlQueryRegistryValues buffer overflow attempt
RuleID : 41365 - Revision : 3 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date Description
2011-02-08 Name : The Windows kernel is affected by several vulnerabilities that could allow es...
File : smb_nt_ms11-011.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:07:55
  • Multiple Updates