PT-2011-2030 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP versions SP2 and SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions SP1 and SP2 Microsoft Windows Server 2008 versions Gold, SP2, and R2 Microsoft Windows 7 Description: The issue arises from t...

CVE-2011-0090

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, ak...

CVE-2011-0040

The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name SPN, which allows remote attackers to cause a denial of service authentication downgrade or outage via a crafted request that triggers name collisions, aka...

CVE-2011-0088

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, ak...

CVE-2011-0030

The Client/Server Run-time Subsystem CSRSS in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly kill processes after a logout, which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute throughout the logout...

Privilege escalation

The Client/Server Run-time Subsystem CSRSS in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly kill processes after a logout, which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute throughout the logout...

Input validation

The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name SPN, which allows remote attackers to cause a denial of service authentication downgrade or outage via a crafted request that triggers name collisions, aka...

Input validation

The Local Security Authority Subsystem Service LSASS in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."...

CVE-2011-0039

The Local Security Authority Subsystem Service LSASS in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."...

CVE-2011-0039

The CVE-2011-0039 entry describes an elevation-of-privilege flaw in the Local Security Authority Subsystem Service (LSASS) on Windows XP SP2/SP3 and Windows Server 2003 SP2. The issue arises when LSASS processes specially crafted authentication requests with a manipulated length, enabling local u...

CVE-2011-0040

The CVE-2011-0040 vulnerability affects Microsoft Active Directory on Windows Server 2003 SP2, where the server mishandles an update request for a Service Principal Name (SPN). This can allow remote attackers to cause a denial of service or authentication outage via crafted SPN update requests th...

Microsoft Windows Active Directory SPN Denial of Service (2478953)

This host is missing a critical security update according to Microsoft Bulletin MS11-005. OpenVAS Vulnerability Test $Id: secpodms11-005.nasl 5362 2017-02-20 12:46:39Z cfi $ Microsoft Windows Active Directory SPN Denial of Service 2478953 Authors: Antu Sanadi Copyright: Copyright c 2011 SecPod,...

CVE-2011-0040

The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name SPN, which allows remote attackers to cause a denial of service authentication downgrade or outage via a crafted request that triggers name collisions, aka...

CVE-2011-0087

The CVE-2011-0087 issue concerns the Windows kernel-mode driver win32k.sys, where user-mode input is not properly validated. This enables local privilege escalation, potentially allowing an attacker to gain complete control of the affected system. Affected products include Windows XP (SP2/SP3), S...

CVE-2011-0089

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, ak...

CVE-2011-0089

CVE-2011-0089 affects Windows kernel-mode driver win32k.sys across multiple OS versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7). The issue is improper validation of user-mode data by the Win32k subsystem, enabling local users to gain privileges via a c...

CVE-2011-0030

CVE-2011-0030 describes a CSRSS Elevation of Privilege vulnerability in Windows XP SP2/SP3 and Windows Server 2003 SP2. The Client/Server Run-time Subsystem (CSRSS) does not properly terminate processes after a user logs out, allowing a local attacker to keep a crafted process running into the ne...

Microsoft Ships 12 Bulletins in February's Patch Tuesday

Microsoft addressed 22 flaws with 12 separate bulletins in February’s edition of Patch Tuesday, including three bulletins that were rated critical with the remaining nine rated as important. Among the programs affected are Microsoft Windows, Internet Explorer, Office, Visual Studio, and IIS. The...

PT-2011-2076 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Windows XP versions SP2 through SP3 Windows Server 2003 version SP2 Windows Vista versions SP1 through SP2 Windows Server 2008 versions Gold through SP2 and R2 Windows 7 affected versions not specified Description: The issue arises from...

Microsoft Windows OpenType Compact Font Format Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability that affects the OpenType Compact Font Format CFF driver. An attacker can exploit this issue to execute arbitrary code in kernel mode. Successful exploits will completely compromise an affected computer. Failed attemp...