 MS Windows CSRSS Vulnerability |
|
|
|
|
  |
 Dec 30 2006, 09:28 PM
Post
#1
|
|
|
Newbie [ Level 2 ]  Group: Members Posts: 14 Joined: 30-December 06 Member No.: 18,945  |
There's a vulnerability in MS Windows that may cause serious problems related with the module csrss.exe .
Here below is listed vulnerable systems: QUOTE Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Vista December CTP Microsoft Windows Vista beta 2 Microsoft Windows Vista Beta 1 Microsoft Windows Vista Beta Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server QUOTE Microsoft Windows Csrss HardError Messages Multiple Vulnerabilities. Microsoft Windows is prone to a local denial-of-service and information disclosure vulnerabilities because the operating system fails to handle certain API calls with unexpected parameters. A local unprivileged attacker may exploit these issues by executing a malicious application. Successful exploits will allow attackers to retrieve sensitive information or crash the operating system, denying further service to legitimate users. Reportedly, these issues may also be exploited to execute arbitrary code with SYSTEM-level privileges. The only way to be secure against this vulnerability is not to download untrusted applications (viruses) . If downloaded, may cause serious problems like information disclosure and etc. With this vulnerability a virusmaker is able to code an exploit that may steal passwords from dial-ups, steal some informations from cookies, or bank accounts , etc. Or a keylogger maybe coded. |
 |
 
|
|
Dec 31 2006, 02:04 PM
Post
#2
|
|
|
Member - Active Contributor Group: Members Posts: 83 Joined: 25-September 06 From: The Netherlands Member No.: 16,153 |
May I ask if the x64 versions are affected also?
They don't seem to be on your version list  Hope not  bakr_2k5 |
|
|
|
|
Dec 31 2006, 04:17 PM
Post
#3
|
|
|
NiGHTFoX - Hiding in the dark Group: Members Posts: 680 Joined: 3-April 05 Member No.: 3,584 |
QUOTE(bakr_2k5 @ Dec 31 2006, 09:04 AM)  May I ask if the x64 versions are affected also? They don't seem to be on your version list Hope not bakr_2k5 Dude, it's M$... of course it's probably affected by x64 versions. What I find funny is that this venerability has been around since Win2K and has spread into some builds of Vista! Who really believes that Vista is a complete re-write?  [N]F |
|
|
|
|
Dec 31 2006, 05:01 PM
Post
#4
|
|
|
Newbie [ Level 2 ] Group: Members Posts: 14 Joined: 30-December 06 Member No.: 18,945 |
QUOTE What I find funny is that this venerability has been around since Win2K and has spread into some builds of Vista! Who really believes that Vista is a complete re-write? Probably you are right. But first of all let's analyze the source code of an exploit given at : _http://downloads.securityfocus.com/vulnerabilities/exploits/21688.c_ In my opinion (i'm not good at coding), probably the kernel of Vista is similar to the kernel of previous versions of Windows (NT based ones) . I mean there maybe similarity with ring0s between Windows versions. Only the change in Vista versions of Windows from previous ones is related to user-level APIs , i think. As known user API calls are directed to ntdll.dll (Native API, not documented). I think MS (or M$ ) did not changed these ntdll functions (or some of them are changed) . They probably changed the kernel32.dll , user32.dll , and especially gdi32.dll (because there are many changes in graphics in Vista) and of course maybe there are some more other changes. And that's why, probably , Vista is also affected too. |
|
|
|
|
Dec 31 2006, 05:13 PM
Post
#5
|
|
|
Newbie [ Level 2 ] Group: Members Posts: 14 Joined: 30-December 06 Member No.: 18,945 |
The only one big problem is that , there isn't any patches for this issue.
So, it may become potentially dangerous. QUOTE Currently we are not aware of any vendor-supplied patches for these issues.
Microsoft has acknowledged the problem with the Client Server Run-Time Subsystem. The vendor is currently investigating the problem to determine its scope and impact. |
|
|
|
 |
Similar Topics
|
Lo-Fi Version | Time is now: 5th September 2008 - 12:05 PM |