SUMware
Premium
join:2002-05-21
edit:
May 13th, @12:26PM
| reply to jdong
Re: WinXP SP2: i2omgmt.sys Privilege Escalation Vulnerability
Looks like MS has provided an incentive to install SP3 (pretty please, or we'll leave your machine vulnerable). 
Also from original link: quote:
III. ANALYSIS
Exploitation allows an attacker to elevate privileges by overwriting arbitrary system memory or executing code within kernel context. An attacker needs to log-in to the target machine to exploit this vulnerability.
This driver is related to I2O protocol and RAID devices. It is not present by default on every Windows installation. However, iDefense found this driver loaded on several systems we tested.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in i2omgmt.sys version 5.1.2600.2180 as installed on some Windows XP SP2 systems. All other Windows releases with this driver, including previous versions, are suspected to be vulnerable.
V. WORKAROUND
Removing write permissions for "Everyone" appears to prevent access to the vulnerable code. Although no side effects were witnessed in lab tests, normal functionality may be hindered.
|
