[Am-info] Microsoft Windows POSIX Subsystem Privilege Escalation Vulnerability

[Fred Miller]

Microsoft Windows POSIX Subsystem Privilege Escalation Vulnerability

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

OPERATING SYSTEM:
Microsoft Windows 2000 Advanced Server
http://secunia.com/product/21/
Microsoft Windows 2000 Datacenter Server
http://secunia.com/product/1177/
Microsoft Windows 2000 Professional
http://secunia.com/product/1/
Microsoft Windows 2000 Server
http://secunia.com/product/20/
Microsoft Windows NT 4.0 Server
http://secunia.com/product/18/
Microsoft Windows NT 4.0 Server, Terminal Server Edition
http://secunia.com/product/19/
Microsoft Windows NT 4.0 Workstation
http://secunia.com/product/15/

DESCRIPTION:
Rafal Wojtczuk has reported a vulnerability in Microsoft Windows,
which can be exploited by malicious, local users to gain escalated
privileges.

The vulnerability is caused due to a boundary error within the POSIX
subsystem and can be exploited to cause a buffer overflow.

Successful exploitation allows execution of arbitrary code with
SYSTEM privileges.

SOLUTION:
Apply patches.

Microsoft Windows NT Workstation 4.0 (requires SP6a):
http://www.microsoft.com/downloads/details.aspx?FamilyId=25993F70-191B-4E35-AA1B-0AA1A7027880&displaylang=en

Microsoft Windows NT Server 4.0 (requires SP6a):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C2018A81-446C-4930-A6CC-EA5B5960FF05&displaylang=en

Microsoft Windows NT Server 4.0 Terminal Server Edition (requires
SP6):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9CFC4AF3-B0BC-4798-BC23-F45739E3B802&displaylang=en

Microsoft Windows 2000 (requires SP2, SP3, or SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=05203A7E-4A11-4F88-AA73-75A6C81466B8&displaylang=en

PROVIDED AND/OR DISCOVERED BY:
Rafal Wojtczuk, McAfee.

ORIGINAL ADVISORY:
MS04-020 (KB841872):
http://www.microsoft.com/technet/security/bulletin/MS04-020.mspx

-- 
"Ballmer is no more designed for the art of persuasion 
than the Abrams tank is for delivering meals on wheels."