CVE-2010-2554

Vulnerability

The Tracing Feature for Services in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 has incorrect ACLs on its registry keys. This allows a local user to exploit the vulnerability via vectors involving a named pipe and impersonation. The vulnerability is publicly disclosed and affects all supported editions of the listed operating systems [1].

Exploitation

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The attack cannot be performed remotely or by anonymous users. The attacker runs a specially crafted application that leverages the incorrect ACLs on the registry keys, using a named pipe and impersonation to gain elevated privileges [1].

Impact

Successful exploitation allows an attacker to elevate privileges on the affected system. The attacker can gain the ability to execute arbitrary code with elevated privileges, potentially leading to full control of the system [1].

Mitigation

Microsoft released security update MS10-059 on August 10, 2010, which addresses this vulnerability by correcting the manner in which tokens are obtained and the length of a string read from the registry is calculated. Customers with automatic updating enabled are protected automatically. Manual installation of the update is recommended for those without automatic updates [1]. No workarounds are documented in the available reference.