Intel LAN Driver OID-handler rettighedseskalering - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Intel LAN Driver OID-handler rettighedseskalering

Secunia Advisory:	SA23221
Udsendt:	2006-12-06
Sidste Opdt.:	2007-04-09

Kritisk:	Mindre kritisk
Betydning:	Rettighedseskalering
Hvor:	Lokalt System
Løsning Status:	Producent Patch

Software:	Intel PRO 10/100 Adapters (Linux) 3.x Intel PRO 10/100 Adapters (UnixWare/SCO6) 4.x Intel PRO 10/100 Adapters (Windows) 8.x Intel PRO/1000 Adapters (Linux) 7.x Intel PRO/1000 Adapters (UnixWare/SCO6) 9.x Intel PRO/1000 Adapters (Windows) 8.x Intel PRO/1000 PCIe Adapters (Windows) 9.x Intel PRO/10GbE Adapters (Linux) 1.x

CVE reference:	CVE-2006-6385 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Beskrivelse: eEye Digital Security har rapporteret en sårbarhed i Intel LAN drivers, som kan udnyttes af ondsindede, lokale brugere til at opnå eskalerede rettigheder. En ikke-kontrolleret buffer i OID-handleren 0xFF0203FC under udførsel af IOCTL_NDIS_QUERY_SELECTED_STATS (0x17000E) forespørgsler til "\Device\{adapterguid}" kan udnyttes til at forårsage et stack-baseret buffer overflow via en lang streng (længere end 370 bytes) suppleret til OID-handleren. Succesfuld udnyttelse muliggør eksekvering af vilkårlig kode med kernel-level rettigheder. Løsning: Installér patches. 10/100: http://support.intel.com/support/network/sb/cs-006103.htm Gigabit: http://support.intel.com/support/network/sb/cs-006120.htm Rapporteret af / Kredit: Derek Soeder, eEye Digital Security. Forløb: 08-12-2006: Tilføjede information fra eEye Digital Security. 11-12-2006: Tilføjede CVE-reference. 19-12-2006: Tilføjede link til US-CERT. 09-04-2007: Opdaterede link til producentens advisory. Original Advisory: Intel: http://security-center.intel.com/advi...d=INTEL-SA-00006&languageid=en-fr eEye Digital Security: http://research.eeye.com/html/advisories/published/AD20061207.html Andre Kilder: US-CERT VU#296681: http://www.kb.cert.org/vuls/id/296681



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Send Feedback to Secunia

Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com. Ideer, foreslag og andet feedback er også meget velkommen.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Apple Safari Cross-Domain Cookie Injection Vulnerability

2.	YouTube Blog Multiple Vulnerabilities

3.	dnsmasq Denial of Service and DNS Cache Poisoning

4.	Moodle Script Insertion and Cross-Site Request Forgery

5.	Geeklog Forum Plugin Search Cross-Site Scripting Vulnerability

6.	SocialEngine SQL Injection and Code Execution

7.	Asterisk Two Denial of Service Vulnerabilities

8.	IPCop update for various packages

9.	Ubuntu update for dnsmasq

10.	Claroline Multiple Cross-Site Scripting Vulnerabilities