Microsoft Pinyin IME (CVE-2011-2010) Local Privilege Escalation Vulnerability

Description

Microsoft Pinyin IME is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.

Technologies Affected

• Microsoft Office Pinyin New Experience Style 2010 (32-bit edition)
• Microsoft Office Pinyin New Experience Style 2010 (64-bit edition)
• Microsoft Office Pinyin SimpleFast Style 2010 (32-bit edition)
• Microsoft Office Pinyin SimpleFast Style 2010 (64-bit edition)
• Microsoft Pinyin IME 2010 (32-bit edition)
• Microsoft Pinyin IME 2010 (64-bit edition)

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
To exploit this vulnerability, an attacker requires local access to an affected computer. Grant local access for trusted and accountable users only.

Vendor updates are available. Please see the reference advisory for more information.