CVE-2011-0087

Vulnerability

An elevation of privilege vulnerability (CVE-2011-0087) exists in the kernel-mode driver win32k.sys on Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2. The flaw is due to insufficient validation of user-mode input passed to the Windows kernel-mode drivers, allowing a crafted application to trigger the vulnerable code path. This vulnerability is one of five addressed in Microsoft Security Bulletin MS11-012 [1].

Exploitation

An attacker must have valid logon credentials and be able to log on locally to the target system. The attacker then runs a specially crafted application that exploits the improper input validation in win32k.sys. No user interaction is required beyond the attacker's own login and execution of the malicious application [1].

Impact

Successful exploitation allows an attacker to gain elevated privileges on the system, potentially achieving complete control over the affected machine. The impact is local privilege escalation, enabling the attacker to execute arbitrary code in kernel mode, which can lead to full compromise of confidentiality, integrity, and availability [1].

Mitigation

Microsoft released security update MS11-012 in February 2011, which corrects the way the Windows kernel-mode drivers validate input passed from user mode. The update is rated Important and is available for all affected Windows versions. Customers with automatic updating enabled are protected automatically; others should apply the update manually. No workaround is documented beyond applying the patch [1].