CVE-2010-4398

high-risk
Published 2010-12-06

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Do I need to act?

~
6.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
15609
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (9)

Affected Vendors

Microsoft

References (27)

Exploit http://isc.sans.edu/diary.html?storyid=9988
Broken Link http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-ua...
Broken Link http://secunia.com/advisories/42356
Third Party Advisory http://support.avaya.com/css/P8/documents/100127248
Not Applicable http://twitter.com/msftsecresponse/statuses/7590788200402945
Broken Link http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7...
Exploit http://www.exploit-db.com/exploits/15609/
Third Party Advisory http://www.kb.cert.org/vuls/id/529673
Broken Link http://www.securityfocus.com/bid/45045
Broken Link http://www.securitytracker.com/id?1025046
Broken Link http://www.vupen.com/english/advisories/2011/0324
Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-01...
Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
Exploit http://isc.sans.edu/diary.html?storyid=9988
Broken Link http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-ua...
Broken Link http://secunia.com/advisories/42356
Third Party Advisory http://support.avaya.com/css/P8/documents/100127248
Not Applicable http://twitter.com/msftsecresponse/statuses/7590788200402945
Broken Link http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7...
Exploit http://www.exploit-db.com/exploits/15609/
and 7 more references
62
/ 100
high-risk
Severity 24/34 · High
Exploitability 23/34 · High
Exposure 15/34 · Moderate