Actu
Vigil@nce - Windows: denial of service via IsHandleEntrySecure
December 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can dereference a NULL pointer in the win2k.sys driver
of Windows, in order to trigger a denial of service.
Impacted products: Windows 2003, Windows 2008, Microsoft Windows
2012, Windows 7, Windows 8, Windows Vista, Windows XP
Severity: 1/4
Creation date: 04/12/2013
DESCRIPTION OF THE VULNERABILITY
The NtUserValidateHandleSecure() function checks a Windows handle.
It calls the IsHandleEntrySecure() function of the win2k.sys
driver.
However, the IsHandleEntrySecure() function does not check if the
pW32Job pointer is NULL, before using it.
An attacker can therefore dereference a NULL pointer in the
win2k.sys driver of Windows, in order to trigger a denial of
service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-denial-of-service-via-IsHandleEntrySecure-13868
