CVE-2016-0099
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
Analysis
Windows Secondary Logon Service improperly processes request handles, allowing local users to escalate privileges to SYSTEM on Windows Vista through Windows 10 via a crafted application.
Technical Context
The CWE-120 buffer overflow in the Secondary Logon Service (seclogon.dll) occurs during handle duplication. An attacker can craft requests that cause the service to impersonate the calling token with elevated privileges, then hijack the impersonation context.
Affected Products
['Microsoft Windows Vista SP2', 'Microsoft Windows 7 SP1', 'Microsoft Windows 8.1', 'Microsoft Windows 10 Gold/1511', 'Microsoft Windows Server 2008/2012/R2', 'Microsoft Windows RT 8.1']
Remediation
Apply Microsoft security update MS16-032. Modern Windows versions have addressed this class of vulnerability. Ensure least-privilege principle is enforced.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today