Vista Exploit Surfaces on Russian Hacker Site

Advertisement (Why?)

Proof-of-concept exploit code for a privilege escalation vulnerability affecting all versions of Windows—including Vista—has been posted on a Russian hacker forum, forcing Microsoft to activate its emergency response process. Mike Reavey, operations manager of the Microsoft Security Response Center, confirmed that the company is "closely monitoring" the public posting, which first appeared on a Russian language forum on Dec. 15. It affects "csrss.exe," which is the main executable for the Microsoft Client/Server Runtime Server.

According to an alert cross-posted to security mailing lists, the vulnerability is caused by a memory corruption when certain strings are sent through the MessageBox API. "The PoC reportedly allows for local elevation of privilege on Windows 2000 SP4, Windows Server 2003 SP1, Windows XP SP1, Windows XP SP2 and Windows Vista operating systems," Reavey said in an entry posted late Dec. 21 on the MSRC blog.

"Initial indications are that in order for the attack to be successful, the attacker must already have authenticated access to the target system. Of course these are preliminary findings and we have activated our emergency response process involving a multitude of folks who are investigating the issue in depth to determine the full scope and potential impact to Microsoft's customers," Reavey added.

View: The full story

News source: eWeek

(6 replies) #1 Andareed on 22 Dec 2006 - 18:00

Just tried this on XP and it works.

#1.1 chaosblade on 22 Dec 2006 - 19:36

Does it require administrator access, As pronounced?

#1.2 Andareed on 22 Dec 2006 - 20:21

Quote - chaosblade said @ #1.1

Nope - got a BSOD on both an admin and limited user account.

#1.3 Express on 22 Dec 2006 - 20:43

So is it just a crash? Or can you actually create an exploit.
I am still scratching my head after looking at the code how do I create an exploit by knowing that the code deallocated the same memory buffer twice.

#1.4 Stunna on 22 Dec 2006 - 22:59

How can I try the exploit on my machine?

#1.5 bjc4ever on 23 Dec 2006 - 02:53

Quote - Stunna said @ #1.4

go to the russian site, download the source code, which is a few lines, compile, run.

#1.6 +Shadowdruid on 23 Dec 2006 - 09:03

Quote - Andareed said @ #1.2

It does not say administrator access...its says AUTHENTICATED access [which means you can use a limited account]

#2 MvT Cracker on 22 Dec 2006 - 19:38

http://www.joejoe.org/forum/index.php?showtopic=3703
please read

(1 reply) #3 bjc4ever on 22 Dec 2006 - 20:42

can someone tell me what's so special about this string

Quote -

"??C:"

i'm sure this is the cause of the crash...

EDIT: urgh i can't get the double back slash to display for some reason

#3.1 Andareed on 22 Dec 2006 - 21:21

It's a prefix for indicating a unicode filename. See: http://msdn.microsoft.com/library/en-us/fi....asp?frame=true

#4 Gobelet on 22 Dec 2006 - 21:00

"Vista Exploit"? It's an exploit affecting W2K, XP, and Vista. Nothing Vista-specific.

#5 +Shadowdruid on 23 Dec 2006 - 09:04

Double news source

Please delete

(5 replies) #6 franzon on 23 Dec 2006 - 10:13

It's a LOCALLY exploitable flaw and the user have to execute a malicious exe in order to get the crash.

Last edited by franzon on 23 Dec 2006 - 10:47

#6.1 Andareed on 23 Dec 2006 - 15:08

It's possible that a remote script may allow executing win32 functions (e.g. php + win32 extensions does), so a remote exploit in this sense is possible.

The point is that a limited vista user won't get a uac prompt.

#6.2 franzon on 23 Dec 2006 - 16:13

Quote - Andareed said @ #6.1

It's possible that a remote script may allow executing win32 functions (e.g. php + win32 extensions does), so a remote exploit in this sense is possible

Please don't say stupidities! It's NOT remotely exploitable.
A local user have to execute a malicious exe.

#6.3 Andareed on 23 Dec 2006 - 23:21

Quote - franzon said @ #6.2

Anything that is able to call MessageBox (directly or indirectly) might be able to trigger this. This includes web-scripts that are able to call MessageBox.

#6.4 franzon on 24 Dec 2006 - 10:48

Quote - Andareed said @ #6.3

Please don't say stupidities!
Web scripts use javascript functions and NOT the Win32 API MessageBox which is used only by the exe programs.
Javascript function MessageBox is TOTALLY DIFFERENT than Win32 API MessageBox (and javascript functions also run in a different enviroment)!!!!

http://secunia.com/advisories/23448/
Critical: Less critical
Where: Local system

Last edited by franzon on 24 Dec 2006 - 11:12

#6.5 Andareed on 24 Dec 2006 - 14:33

Quote - franzon said @ #6.4

I was talking about php server "web" scripts. I'm not talking about javascript "MessageBox" (do you mean window.alert?). I've actually confirmed that with the win32api php extension, this exploit is possible.

Stop emphasizing "Local System". Everything I've mentioned targets a local system

#7 David3k on 23 Dec 2006 - 10:14

the attacker must already have authenticated access to the target system.

FAIL!

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net