Vulnerability Note VU#953860

Microsoft Windows privilege escalation vulnerability

Original Release date: 07 Feb 2006 | Last revised: 21 Apr 2006


Microsoft Windows access controls may be improperly configured potentially allowing a local attacker to gain elevated privileges on a vulnerable system.


Microsoft Windows provides numerous, fine grained permissions and privileges to control access to Windows components, such as services, files, and registry entries.

Recent research has uncovered insecure configurations within user accounts and groups on Microsoft Windows systems. These configurations may allow local attackers to gain access to, and manipulate system resources. The researchers have developed a model that analyzes permissions to expose privilege escalation vulnerabilities. The research focused on three particular components of the Windows architecture:


    Windows services may be installed and configured with unnecessary privileges. This may allow a lesser privileged user to access and change the settings for a service that runs with greater privileges. Of particular concern are the following privileges:

    The SERVICE_CHANGE_CONFIG access right allows a user to change the a service's configuration. This includes the executable that services launches and the user account with which a service runs as. According to Microsoft, "Because this grants the caller the right to change the executable file that the system runs, it should be granted only to administrators."

    The SERVICE_ALL_ACCESS access right allows a user full control over a service.
Files and Directories
    Any privileges that allow the contents of a file or a directory to be modified should be granted to only trusted users. The following access rights a of particular concern:

    The FILE_ALL_ACCESS access right allows a user to completely control a file, including read, write and execute privileges.

    The FILE_APPEND_DATA access right allows a user to add data to a file.

    The FILE_WRITE_DATA access right allows a user to write and rewrite data to a file.

Registry Keys
    Users with KEY_SET_VALUE permissions can modify registry keys that specify executables, DLLs, and/or Globally Unique Identifiers (GUIDs).

The WRITE_DAC access right provides the ability to modify the access control list for a resource. Users granted this right have the ability to change the way they, or other users, access a resource. This may allow attackers to grant themselves, or others arbitrary permissions over a resource.

Note that these issues can affect all software that is developed for the Microsoft Windows platform. Known Windows services that have weak permissions include, but may not belimited to
  • Microsoft SSDP Discovery service (SSDPSRV)
  • NetBios over TCP/IP service (NetBT)
  • Smart Card service (SCardSvr)
  • Universal Plug and Play Device Host service (upnphost)
  • DNS Client service (Dnscache)
  • DHCP Client service (Dhcp)


A local user with valid login credentials may be able gain elevated privileges on a vulnerable Windows system.

We are aware of publicly available exploit code that claims to be a tool to identify vulnerable services. Installing and running this code may allow a remote attacker to gain access to a system.


These issues are corrected in Service Pack 2 for Microsoft Windows XP and Service Pack 1 for Microsoft Windows Server 2003. In addition, Microsoft Security Advisory 914457 and Microsoft Security Bulletin MS06-011 contain numerous workarounds to mitigate these vulnerabilities.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AdobeAffected28 Nov 200508 Feb 2006
Macromedia, Inc.Affected29 Nov 200508 Feb 2006
Microsoft CorporationAffected28 Nov 200508 Feb 2006
Appgate Network SecurityNot Affected14 Dec 200509 Feb 2006
FujitsuNot Affected14 Dec 200521 Apr 2006
Oracle CorporationNot Affected14 Dec 200508 Feb 2006
ACROS SIUnknown14 Dec 200508 Feb 2006
AlcatelUnknown14 Dec 200508 Feb 2006
America Online, Inc.Unknown28 Nov 200508 Feb 2006
Apache HTTP Server ProjectUnknown14 Dec 200508 Feb 2006
Apple Computer, Inc.Unknown14 Dec 200508 Feb 2006
BitviseUnknown14 Dec 200508 Feb 2006
Check Point Software TechnologiesUnknown14 Dec 200508 Feb 2006
Cisco Systems, Inc.Unknown14 Dec 200508 Feb 2006
eBayUnknown14 Dec 200508 Feb 2006
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



These vulnerabilities were reported by Sudhakar Govindavajhala and Andrew W. Appel.

This document was written by Jeff Gennari.

Other Information

  • CVE IDs: CVE-2006-0023
  • Date Public: 31 Jan 2006
  • Date First Published: 07 Feb 2006
  • Date Last Updated: 21 Apr 2006
  • Severity Metric: 4.22
  • Document Revision: 68


If you have feedback, comments, or additional information about this vulnerability, please send us email.