MS Windows Local Privilege Escalation Zero-Day in The Wild
FireEye Labs has
identified a new Windows local privilege escalation vulnerability in
the wild. The vulnerability cannot be used for remote code execution
but could allow a standard user account to execute code in the kernel.
Currently, the exploit appears to only work in Windows XP.
This local privilege escalation vulnerability is used in-the-wild in
conjunction with an Adobe Reader exploit that appears to target a
patched vulnerability. The exploit targets href="http://www.adobe.com/support/security/bulletins/apsb13-15.html">Adobe
Reader 9.5.4, 10.1.6, 11.0.02 and prior on Windows XP SP3. Those
running the latest versions of Adobe Reader should not be affected by
this exploit.
Post exploitation, the shellcode decodes a PE payload from the PDF,
drops it in the temporary directory, and executes it.
Mitigations
The following actions will protect users from the in-the-wild PDF exploit:
1) Upgrade to the latest Adobe Reader
2) Upgrade to Microsoft Windows 7 or higher
This post was intended to serve as a warning to the generic public.
We are collaborating with the Microsoft Security team on research
activities. Microsoft assigned CVE-2013-5065 to this issue.
We will continue to update this blog as new information about this
threat is found.
[Update]: Microsoft released href="http://technet.microsoft.com/en-us/security/advisory/2914486">security
advisory 2914486 on this issue.
Source:
MS Windows Local Privilege Escalation Zero-Day in The Wild
