Vulnerability Note VU#768440

Microsoft Windows Services for UNIX privilege escalation vulnerability

Overview

Microsoft Windows Services for UNIX contains a vulnerability that may allow a local, authenticated attacker to gain elevated privileges.

I. Description

Windows Services for UNIX fails to properly handle setuid binary files. An attacker may be able to trigger this vulnerability by running a specially crafted setuid binary file.

For more information, please see Microsoft Security Bulletin MS07-053.

II. Impact

A local, authenticated attacker may be able to gain elevated privileges on a vulnerable system.

III. Solution

Microsoft has released updates in Microsoft Security Bulletin MS07-053 to address this issue.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	12-Sep-2007

References

http://www.microsoft.com/technet/security/bulletin/ms07-053.mspx
http://secunia.com/advisories/26757/

Credit

This vulnerability was reported in Microsoft Security Bulletin MS07-053. Microsoft thanks Brian Reiter of WolfeReiter for reporting the vulnerability to them.

This document was written by Katie Steiner.

Other Information

Date Public:	2007-09-11
Date First Published:	2007-09-12
Date Last Updated:	2007-09-12
CERT Advisory:
CVE-ID(s):	CVE-2007-3036
NVD-ID(s):	CVE-2007-3036
US-CERT Technical Alerts:
Metric:	0.37
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader