---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation compensation package. http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: Microsoft Windows Two Vulnerabilities SECUNIA ADVISORY ID: SA21417 VERIFY ADVISORY: http://secunia.com/advisories/21417/ CRITICAL: Highly critical IMPACT: Privilege escalation, System access WHERE: >From remote OPERATING SYSTEM: Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows XP Professional http://secunia.com/product/22/ DESCRIPTION: Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to compromise a vulnerable system. 1) An error in Winlogon when searching for DLL files when applications are started can be exploited by a malicious, local user to gain escalated privileges by placing a malicious DLL file in the user directory. NOTE: Only Windows 2000 is affected by default as other OS versions have "SafeDllSearchMode" set to "1" by default. 2) An error in the exception handling management when multiple applications are resident in memory can be exploited to execute arbitrary code by tricking a user into visiting a malicious website. SOLUTION: Apply patches. Windows 2000 SP4: http://www.microsoft.com/downloads/details.aspx?FamilyId=83e0c6fb-a542-463a-88fd-dc388605a8ae Windows XP SP1/SP2: http://www.microsoft.com/downloads/details.aspx?FamilyId=71e96afc-bc4d-4666-998b-49857007e539 Windows XP Professional x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=a6fe5b95-11d1-42cd-995c-c8cef8a27aef Windows Server 2003 (optionally with SP1): http://www.microsoft.com/downloads/details.aspx?FamilyId=7d0f888b-df35-40df-baff-0bae2b921aef Windows Server 2003 for Itanium-based systems (optionally with SP1): http://www.microsoft.com/downloads/details.aspx?FamilyId=df365b0b-f97f-4df1-9105-d81b68a110eb Windows Server 2003 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=3f750ad5-5bfb-4421-a316-ae66f0557eac PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Reed Arvin, Canaudit Inc. 2) The vendor credits Matt Miller, Leviathan Security Group working with Ken Johnson. ORIGINAL ADVISORY: MS06-051 (KB917422): http://www.microsoft.com/technet/security/Bulletin/MS06-051.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------