NVD

Id
39417  
Name
CVE-2013-3660  
Description
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2013-05-24  
Modified Date
2013-11-02  
Seq
2013-3660  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
200978 39417 CVE-2013-3660 20130517 exploitation ideas under memory pressure  View
200979 39417 CVE-2013-3660 20130517 Re: exploitation ideas under memory pressure  View
200980 39417 CVE-2013-3660 20130603 Re: exploitation ideas under memory pressure  View
200981 39417 CVE-2013-3660 oval:org.mitre.oval:def:17360  View
200982 39417 CVE-2013-3660 MS13-053  View
200983 39417 CVE-2013-3660 http://twitter.com/taviso/statuses/309157606247768064  View
200984 39417 CVE-2013-3660 http://twitter.com/taviso/statuses/335557286657400832  View
200985 39417 CVE-2013-3660 http://www.computerworld.com/s/article/9239477  View
200986 39417 CVE-2013-3660 25611  View
200987 39417 CVE-2013-3660 http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/  View
200988 39417 CVE-2013-3660 http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw  View
200989 39417 CVE-2013-3660 TA13-190A  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
21264 JVNDB-2013-002839 Microsoft Windows のカーネルモードドライバの win32k.sys の EPATHOBJ::pprFlattenRec 関数における権限昇格の脆弱性 Microsoft Windows のカーネルモードドライバの win32k.sys の EPATHOBJ::pprFlattenRec 関数は、特定のリスト内の次のオブジェクトへのポインタを適切に初期化しないため、PATHRECORD チェーンへの書き込み権限を取得され、その結果、権限を取得される脆弱性が存在します。 CVE-2013-3660 63602 CVE-2013-3660 39417 6.9 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002839.html 2013-05-23 2013-07-24 View