Secunia

Sudhakar Govindavajhala and Andrew W. Appel have reported some security issues in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

Insecure SERVICE_CHANGE_CONFIG permissions on the UPNPHost, NetBT, SCardSvr, DHCP, DnsCache, and SSDPSRV services can be exploited to gain escalated privileges by changing the associated program set to run by an identified service.

Successful exploitation allows an arbitrary program to be executed when an affected service is restarted.

The security issues have been reported in Windows XP SP1 (all listed services) and Windows Server 2003 (NetBT service). The vendor reports that Windows XP SP2 and Windows Server 2003 SP1 are unaffected.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Sudhakar Govindavajhala and Andrew W. Appel

The vendor also credits Andres Tarasco of SIA Group.

Changelog
Further details available in Customer Area

Original Advisory
MS06-011 (KB914798):
http://www.microsoft.com/technet/security/bulletin/ms06-011.mspx

Microsoft:
http://www.microsoft.com/technet/security/advisory/914457.mspx

Sudhakar Govindavajhala and Andrew W. Appel:
http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area