jdong
Eat A Beaver, Save A Tree.
Premium
join:2002-07-09
Rochester, MI
clubs:  
| reply to matunga
Re: WinXP SP2: i2omgmt.sys Privilege Escalation Vulnerability
Isn't this loaded by default on XP systems? Why wasn't this fixed when the vendor was notified? Grouping together minor bugfixes into a yearly big update is a good idea, but for priviledge escalation vulnerabilities is it really appropriate?
--
Ubuntu MOTU Developer and Forums Council |
|
SUMware
Premium
join:2002-05-21
edit:
May 13th, @12:26PM
| Looks like MS has provided an incentive to install SP3 (pretty please, or we'll leave your machine vulnerable). 
Also from original link: quote:
III. ANALYSIS
Exploitation allows an attacker to elevate privileges by overwriting arbitrary system memory or executing code within kernel context. An attacker needs to log-in to the target machine to exploit this vulnerability.
This driver is related to I2O protocol and RAID devices. It is not present by default on every Windows installation. However, iDefense found this driver loaded on several systems we tested.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in i2omgmt.sys version 5.1.2600.2180 as installed on some Windows XP SP2 systems. All other Windows releases with this driver, including previous versions, are suspected to be vulnerable.
V. WORKAROUND
Removing write permissions for "Everyone" appears to prevent access to the vulnerable code. Although no side effects were witnessed in lab tests, normal functionality may be hindered.
|
|
