Microsoft Windows Local Procedure Call CVE-2013-3878 Local Privilege Escalation Vulnerability

Description

Microsoft Windows is prone to a local privilege-escalation vulnerability that affects the Local Procedure Call (LPC) component. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.

Technologies Affected

• Avaya CallPilot 4.0
• Avaya CallPilot 4.0.1
• Avaya CallPilot 5.0
• Avaya CallPilot 5.0.1
• Avaya CallPilot
• Avaya Communication Server 1000 Telephony Manager 3.0
• Avaya Communication Server 1000 Telephony Manager 3.0.1
• Avaya Communication Server 1000 Telephony Manager 4.0
• Avaya Communication Server 1000 Telephony Manager 4.0.1
• Avaya Communication Server 1000 Telephony Manager
• Avaya Messaging Application Server 4
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server 5.0
• Avaya Messaging Application Server 5.0.1
• Avaya Messaging Application Server 5.2
• Avaya Messaging Application Server 5.2.1
• Avaya Messaging Application Server
• Microsoft Windows Server 2003 Itanium SP2
• Microsoft Windows Server 2003 SP2
• Microsoft Windows Server 2003 x64 Edition Service Pack 2
• Microsoft Windows XP Professional x64 Edition SP2
• Microsoft Windows XP Service Pack 3

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
To exploit this vulnerability, an attacker requires local access to an affected computer. Grant local access for trusted and accountable users only.

Vendor updates are available. Please see the referenced advisory for more information.