Actu
Vigil@nce - Windows: privilege elevation via NVIDIA
March 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use three vulnerabilities of the NVIDIA driver, in
order to elevate his privileges.
Impacted products: Windows 2003, Windows 2008, Microsoft Windows
2012, Windows 7, Windows 8, Windows Vista, Windows XP
Severity: 2/4
Creation date: 14/03/2013
DESCRIPTION OF THE VULNERABILITY
Three vulnerabilities were announced in the NVIDIA driver for
Windows.
A local attacker can corrupt the memory, in order to execute code
with privileges of the administrator. [severity:2/4; CVE-2013-0109]
An attacker can use NVIDIA Stereoscopic 3D Driver Service
(nvSCPAPISvr.exe) to execute code. [severity:2/4; CVE-2013-0110]
An attacker can use NVIDIA Update Service Daemon (daemonu.exe) to
execute code. [severity:2/4; CVE-2013-0111]
An attacker can therefore use three vulnerabilities of the NVIDIA
driver, in order to elevate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-privilege-elevation-via-NVIDIA-12526
