漏洞信息详情

Microsoft Windows #GP陷阱处理器本地权限提升漏洞

  • CNNVD编号:CNNVD-201001-215
  • 危害等级: 高危
  • CVE编号: CVE-2010-0232
  • 漏洞类型: 权限许可和访问控制
  • 发布时间: 2010-01-21
  • 威胁类型: 本地
  • 更新时间: 2019-04-02
  • 厂        商: microsoft
  • 漏洞来源: Tavis Ormandy tav...

漏洞简介

Microsoft Windows是美国微软(Microsoft)公司发布的一系列操作系统。

Windows的内核#GP陷井处理例程对执行的环境做了一些不正确的假设,本地普通用户权限的攻击者可以通过伪造执行环境中的数据使操作系统在ring0层执行指定的任意指令,从而取得对系统的完全控制。此漏洞影响几乎所有的x86 32位的Windows系统。 为了在老式的16位应用中支持BIOS服务例程,Windows NT内核支持Virtual-8086模式监控代码中的BIOS调用,分两个阶段实现。当#GP陷阱处理器(nt!KiTrap0D)检测到出错的cs:eip匹配了特定的magic value,内核就会过渡到第二阶段。一旦确认了真实性,过渡到第二阶段就会涉及到从出错的陷阱帧恢复之前所保存的执行上下文和调用栈。 由于这个验证依赖于以下错误的假设: - 创建VDM上下文需要SeTcbPrivilege - ring3代码无法安装任意代码段选择器 - ring3代码无法伪造陷阱帧 本地攻击者可以创建伪造的VDM上下文,然后通过触发异常导致内核栈返回到受控的地址,导致执行任意内核态代码。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:

Microsoft Windows XP Media Center Edition SP2

Microsoft Security Update for Windows XP (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=e2b348f5-ec8d -4782-bb03-5de550adea77

Microsoft Windows XP Tablet PC Edition SP2

Microsoft Security Update for Windows XP (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=e2b348f5-ec8d -4782-bb03-5de550adea77

Microsoft Windows XP Media Center Edition SP3

Microsoft Security Update for Windows XP (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=e2b348f5-ec8d -4782-bb03-5de550adea77

Microsoft Windows 7 for 32-bit Systems 0

Microsoft Security Update for Windows 7 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=66f14bb4-40fc -4ae3-9baf-429b7106cd91

Microsoft Windows Server 2003 Web Edition SP2

Microsoft Security Update for Windows Server 2003 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=defd8603-ed9b -42f9-a539-2b6a690e9575

Microsoft Windows Vista 0

Microsoft Security Update for Windows Vista (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=2761c7b4-d472 -4f00-949b-af3ebafdc08d

Microsoft Windows XP Tablet PC Edition SP3

Microsoft Security Update for Windows XP (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=e2b348f5-ec8d -4782-bb03-5de550adea77

Microsoft Windows Vista SP1

Microsoft Security Update for Windows Vista (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=2761c7b4-d472 -4f00-949b-af3ebafdc08d

Microsoft Windows 2000 Advanced Server SP4

Microsoft Security Update for Windows 2000 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=ed8ac6a5-c8bb -4ed4-8994-810e9a1863c3

3DM Software Disk Management Software SP2

Microsoft Security Update for Windows Server 2003 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=defd8603-ed9b -42f9-a539-2b6a690e9575

Microsoft Windows Server 2003 Standard Edition SP2

Microsoft Security Update for Windows Server 2003 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=defd8603-ed9b -42f9-a539-2b6a690e9575

Microsoft Windows XP Home SP2

Microsoft Security Update for Windows XP (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=e2b348f5-ec8d -4782-bb03-5de550adea77

Microsoft Windows 2000 Datacenter Server SP4

Microsoft Security Update for Windows 2000 (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=ed8ac6a5-c8bb -4ed4-8994-810e9a1863c3

Microsoft Windows Vista SP2

Microsoft Security Update for Windows Vista (KB977165)

http://www.microsoft.com/downloads/details.aspx?familyid=2761c7b4-d472 -4f00-949b-af3ebafdc08d

参考网址

来源:CONFIRM

链接:http://blogs.technet.com/msrc/archive/2010/01/20/security-advisory-979682-released.aspx

来源:FULLDISC

链接:http://seclists.org/fulldisclosure/2010/Jan/341

来源:SECTRACK

链接:http://securitytracker.com/id?1023471

来源:MLIST

链接:http://lists.immunitysec.com/pipermail/dailydave/2010-January/006000.html

来源:BID

链接:http://www.securityfocus.com/bid/37864

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2010/0179

来源:SECUNIA

链接:http://secunia.com/advisories/38265

来源:CERT

链接:http://www.us-cert.gov/cas/techalerts/TA10-040A.html

来源:BUGTRAQ

链接:http://www.securityfocus.com/archive/1/509106/100/0/threaded

来源:CONFIRM

链接:http://www.microsoft.com/technet/security/advisory/979682.mspx

来源:XF

链接:https://exchange.xforce.ibmcloud.com/vulnerabilities/55742

来源:MISC

链接:http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip

来源:OVAL

链接:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8344

来源:MS

链接:https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-015

漏洞信息快速查询

相关漏洞

更多