Vulnerability Note VU#953860

Microsoft Windows privilege escalation vulnerability

Recent research has uncovered insecure configurations within user accounts and groups on Microsoft Windows systems. These configurations may allow local attackers to gain access to, and manipulate system resources. The researchers have developed a model that analyzes permissions to expose privilege escalation vulnerabilities. The research focused on three particular components of the Windows architecture:

Services

Windows services may be installed and configured with unnecessary privileges. This may allow a lesser privileged user to access and change the settings for a service that runs with greater privileges. Of particular concern are the following privileges:

The SERVICE_CHANGE_CONFIG access right allows a user to change the a service's configuration. This includes the executable that services launches and the user account with which a service runs as. According to Microsoft, "Because this grants the caller the right to change the executable file that the system runs, it should be granted only to administrators."

The SERVICE_ALL_ACCESS access right allows a user full control over a service.

Any privileges that allow the contents of a file or a directory to be modified should be granted to only trusted users. The following access rights a of particular concern:

The FILE_ALL_ACCESS access right allows a user to completely control a file, including read, write and execute privileges.

The FILE_APPEND_DATA access right allows a user to add data to a file.

The FILE_WRITE_DATA access right allows a user to write and rewrite data to a file.

Users with KEY_SET_VALUE permissions can modify registry keys that specify executables, DLLs, and/or Globally Unique Identifiers (GUIDs).

• Microsoft SSDP Discovery service (SSDPSRV)
• NetBios over TCP/IP service (NetBT)
• Smart Card service (SCardSvr)
• Universal Plug and Play Device Host service (upnphost)
• DNS Client service (Dnscache)
• DHCP Client service (Dhcp)

We are aware of publicly available exploit code that claims to be a tool to identify vulnerable services. Installing and running this code may allow a remote attacker to gain access to a system.

III. Solution

Systems Affected

http://www.microsoft.com/technet/security/advisory/914457.mspx
http://www.microsoft.com/technet/security/Bulletin/MS06-011.mspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/file_security_and_access_rights.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/service_security_and_access_rights.asp
http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf
http://support.microsoft.com/?id=914392

Credit

These vulnerabilities were reported by Sudhakar Govindavajhala and Andrew W. Appel.

This document was written by Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.