Microsoft jumps as Win XP local priv escalation exploited

By

Affects Server 2003.

Microsoft is investigating attacks against Windows XP and Server 2003 via a vulnerability found in the wild that allows standard users to execute code in the kernel.

Microsoft jumps as Win XP local priv escalation exploited

The local privilege escalation flaw does not permit remote code execution and works only in the old Windows offerings.

"The vulnerability is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights," Microsoft wrote in an advisory.

FireEye researchers Xiaobo Chen and Dan Caselden who discovered the flaw said it was used in conjunction with a since-patched Adobe Reader exploit targeting versions 9.5.4, 10.1.6, 11.0.02 and prior. It could allow users to bypass the Adobe sandbox.

"The exploit produces shellcode which decoded a PE payload from the PDF, drops it in the temporary directory, and executes it," they wrote.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

SA Water plans 'once-in-a-generation' core technology uplift

SA Water plans 'once-in-a-generation' core technology uplift

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

WhatsApp banned on US House of Representatives devices

WhatsApp banned on US House of Representatives devices

Victoria's first government tech chief steps down

Victoria's first government tech chief steps down

Log In

  |  Forgot your password?