Actu
Vigil@nce: Windows, privilege elevation via LSASS
February 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
A local attacker can use a vulnerability of LSASS, in order to
elevate his privileges.
– Severity: 2/4
– Creation date: 09/02/2011
IMPACTED PRODUCTS
– Microsoft Windows 2003
– Microsoft Windows XP
DESCRIPTION OF THE VULNERABILITY
The LSASS (Local Security Authority Subsystem Service) service
processes the authentication of users.
A local attacker can send an authentication query with an invalid
size. A memory corruption then occurs in the LSASS service.
A local attacker can therefore use a vulnerability of LSASS, in
order to elevate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-privilege-elevation-via-LSASS-10352
