Actu
Vigil@nce: Windows, several vulnerabilities of kernel
October 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
Several vulnerabilities of the Windows kernel can be used by a
local attacker to create a denial of service or to elevate his
privileges.
– Severity: 2/4
– Creation date: 13/10/2010
DESCRIPTION OF THE VULNERABILITY
Several vulnerabilities were announced in the Windows kernel, and
can be used by a local attacker to gain system privileges.
A local attacker can use the NtUserCheckAccessForIntegrityLevel()
system call, in order to create a denial of service or to execute
code with system privileges (VIGILANCE-VUL-9737
(https://vigilance.fr/tree/1/9737)). [severity:2/4; BID-41280,
CVE-2010-2549]
An attacker can load a malicious keyboard loayout, in order to
corrupt an array of function pointers, which leads to code
execution (VIGILANCE-VUL-9977 (https://vigilance.fr/tree/1/9977)).
[severity:2/4; BID-43774, CVE-2010-2743]
An attacker can use a malicious window class, in order to corrupt
the memory, which leads to code execution (VIGILANCE-VUL-9978
(https://vigilance.fr/tree/1/9978)). [severity:2/4; BID-43773,
CVE-2010-2744]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-several-vulnerabilities-of-kernel-10020
