Vulnerability Bulletins |
Aumento de privilegios en LSASS de Microsoft Windows |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de privilegios |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 SP2 Storage Management Appliance v2.1 Storage Management Appliance I Storage Management Appliance II Storage Management Appliance III |
Description |
|
|
Se ha encontrado una vulnerabilidad en Microsoft Windows en las versiones 2000 con Service Pack 4, XP con Service Pack 2 y Server 2003 con Service Pack 1 y Service Pack 2. La vulnerabilidad reside en la manera en como el Local Security Authority Subsystem Service (LSASS) maneja las peticiones LPC (Local Procedure Call) Un atacante local podría aumentar sus privilegios mediante una petición LPC especialmente diseñada. |
|
Solution |
|
|
Actualización de software Microsoft Windows 2000 Service Pack 4 / patch Windows2000-kb943485-x86-enu Windows XP / patch Windowsxp-kb943485-x86-enu Windows XP x64 Edition / patch Windowsserver-2003.Windows XP-KB943485-x64-ENU.exe Windows Server 2003 / patch Windowsserver2003-kb943485-x86-enu Windows Server 2003 x64 Edition / patch Windowsserver2003.WindowsXP-kb943485-x64-enu Windows Server 2003 Itanium Edition / patch Windowsserver2003-kb943485-ia64-enu HP Instalar las actualizaciones de Microsoft |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2007-5352 |
| BID | |
Other resources |
|
|
Microsoft Security Bulletin MS08-002 http://www.microsoft.com/technet/security/bulletin/ms08-002.mspx HP SECURITY BULLETIN (HPSBST02304) http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01325239-1 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2008-01-10 |
| 1.1 | Aviso emitido por HP (HPSBST02304) | 2008-01-18 |