Description
Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multiple ApiPort connections, which leaves a "dangling pointer" to a process data structure.
References
- HPSBST02208 vendor-advisory
- 1017897 vdb-entry
- 23338 vdb-entry
- oval:org.mitre.oval:def:1524 vdb-entry signature
- MS07-021 vendor-advisory
- VU#219848 third-party-advisory
- ADV-2007-1325 vdb-entry
- 34008 vdb-entry
- 2531 third-party-advisory
- 24823 third-party-advisory
- http://research.eeye.com/html/advisories/published/AD20070410b.html
- TA07-100A third-party-advisory
- 20070410 EEYE: Windows Vista CSRSS Dangling Process Pointer Privilege Escalation mailing-list