# MA-259.112010: MyCERT Alert - Two Critical Vulnerabilities in Microsoft Windows

**Date:** 26 Nov 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-259.112010  
**Advisory ID:** MA-259.112010

---

**1.0 Introduction**
Two critical vulnerabilities have been identified in the Microsoft Windows that can be exploited by malicious local users, to gain escalated privileges as SYSTEM-level.
The vulnerabilities exist because of:
- Buffer overflow in win32k.sys
- There is buffer overflow vulnerability in win32k.sys, which is part of the Windows kernel. The flaw is 
- Insufficient integrity checks of the Task Scheduler jobs.
- Access validation error in the Task Scheduler service that fails to prevent users from manipulating certain fields in schema XML files via the Component Object Model (COM) interface, which could allow malicious users to manipulate a valid XML file and bypass the CRC32 integrity checks to execute arbitrary code with SYSTEM privileges.
MyCERT is aware that '0-day' exploits are available in the wild at the time of the publication of this advisory.
**2.0 Impact**
An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Windows Vista SP1 / SP2
- Windows Vista x64 Edition SP1 / SP2
- Windows Server 2008 for 32-bit Systems SP1 / SP2
- Windows Server 2008 x64 Edition SP1 / SP2
- Windows Server 2008 for x64-based Systems (optionally with SP2)
- Windows Server 2008 for Itanium-based Systems (optionally with SP2)
- Windows Server 2008 R2
- Windows 7
**4.0 Recommendations**
As of the writing of this advisory, Microsoft has not released any security patches for this vulnerability. However, users can use the following steps as a temporary workaround:
- Grant only trusted users access to affected systems.
- Change the Permission Entry for EUDC
- As an Administrator open Regedit and browse to HKEY\_USERS\[SID of each user account]\EUDC
- Right-click EUDC and choose permissions
- Choose the user whose account you are modifying and select Advanced
- Select Add and then type in the user's name and click OK
- Click the Deny checkbox for Delete and Create Subkey
- Click all the OKs and Apply buttons to exit
> > *\* The registry keys being changed by this mitigation should not impact a user's ability to use the system, but changing permissions 
MyCERT would like to advise the users of Microsoft Windows to be vigilant of the latest security announcements by Microsoft and ensure that their operating systems are automatically updated. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#e78a9e84829593a78a9e84829593c9889580c98a9e)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/#comments>
- <http://isc.sans.edu/diary.html?storyid=9988>
- <http://softwareobjects.net/technology/other/bypassing-uac-with-user-privilege-under-windows-vista7/>
- <http://www.vupen.com/english/advisories/2010/2761>
- <http://www.securityfocus.com/bid/44357>
- <http://secunia.com/advisories/41525/>
- <https://metasploit.com/redmine/projects/framework/repository/revisions/11079/entry/scripts/meterpreter/schelevator.rb>