Multiple privilege escalation vulnerabilities in Win32k.sys in Microsoft Windows
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2010-2744 CVE-2010-2549 CVE-2010-2743 |
| CWE-ID | CWE-20 CWE-911 CWE-129 |
| Exploitation vector | Local |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Vulnerability #3 is being exploited in the wild. |
| Vulnerable software |
Windows Operating systems & Components / Operating system Windows Server Operating systems & Components / Operating system |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU5544
Risk: Low
CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2010-2744
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to an error in Win32k.sys driver when validating window class data. A local user can execute arbitrary code on the target system with SYSTEM privileges.
Successful exploitation of this vulnerability may allow an attacker to escalate privileges on vulnerable system.
MitigationInstall updates from vendor's website.
Windows: XP - 7
Windows Server: 2003 - 2008
CPE2.3- cpe:2.3:o:microsoft:windows:XP:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:Vista:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*
https://technet.microsoft.com/en-us/library/security/ms10-073.aspx
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Reference count error
EUVDB-ID: #VU5543
Risk: Low
CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2010-2549
CWE-ID:
CWE-911 - Improper Update of Reference Count
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to an error in Win32k.sys driver when updating reference count for an object. A local user can execute arbitrary code on the target system with SYSTEM privileges.
Successful exploitation of this vulnerability may allow an attacker to escalate privileges on vulnerable system.
MitigationInstall updates from vendor's website.
Windows: Vista
Windows Server: 2008
CPE2.3https://technet.microsoft.com/en-us/library/security/ms10-073.aspx
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Improper validation of array index
EUVDB-ID: #VU5542
Risk: Medium
CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Green]
CVE-ID: CVE-2010-2743
CWE-ID:
CWE-129 - Improper Validation of Array Index
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to an error in Win32k.sys driver when handling keyboard layouts as the Windows kernel fails to validate that an array index is within the bounds of the array. A local user can load a specially crafted keyboard layout and execute arbitrary code on the target system with privileges of SYSTEM account.
Successful exploitation of this vulnerability may allow an attacker to escalate privileges on vulnerable system.
Note: this vulnerability is being actively exploited by Stuxnet. MitigationInstall updates from vendor's website.
Windows: XP - 7
Windows Server: 2003 - 2008
CPE2.3https://technet.microsoft.com/en-us/library/security/ms10-073.aspx
https://www.us-cert.gov/ncas/alerts/TA10-285A
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
