Description
The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view, which allows local users to gain privileges by modifying the "zero page" during a race condition before the view is unmapped.
References
- HPSBST02208 vendor-advisory
- 23367 vdb-entry
- 34011 vdb-entry
- oval:org.mitre.oval:def:1639 vdb-entry signature
- MS07-022 vendor-advisory
- VU#337953 third-party-advisory
- ADV-2007-1326 vdb-entry
- 20070410 EEYE: Windows VDM Zero Page Race Condition Privilege Escalation mailing-list
- 24834 third-party-advisory
- 1017898 vdb-entry
- TA07-100A third-party-advisory
- http://research.eeye.com/html/advisories/published/AD20070410a.html