CVE-2005-2827

An attacker must have valid logon credentials and be able to log on locally to the affected system [ref_id=1]. The attacker runs a specially-crafted application that triggers a flaw in the APC queue processing during thread termination. In this condition, the terminating thread causes APC entries to free the wrong data, allowing the attacker to modify kernel memory and redirect execution flow to gain elevated privileges [ref_id=1]. The vulnerability cannot be exploited remotely or by anonymous users.

The vulnerability resides in the Windows kernel (NTOSKRNL.EXE) for Windows NT 4.0 and Windows 2000. The affected component is the thread termination routine that processes Asynchronous Procedure Call (APC) queue entries [ref_id=1]. No specific function names or file paths beyond the kernel image are disclosed in the advisory.

The security update addresses the vulnerability by modifying the way that Asynchronous Procedure Call (APC) queues are processed during thread termination [ref_id=1]. The patch ensures that APC entries are correctly freed, preventing the freeing of wrong data that could lead to kernel memory corruption. No further technical details about the specific code change are provided in the advisory.