Arkon has discovered a vulnerability in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error in win32k.sys within the "CreateDIBPalette()" function when copying colour values into a buffer allocated with a fixed size when creating the DIB palette. This can be exploited via the "GetClipboardData()" API to cause a buffer overflow by specifying a large number of colours (greater than 256) via the "biClrUsed" field in a BITMAPINFOHEADER structure.

Successful exploitation may allow execution of arbitrary code with kernel privileges.

The vulnerability is confirmed in fully patched versions of Windows XP SP3, Windows Server 2003 R2 Enterprise SP2, Windows Vista Business SP1, Windows 7, and Windows Server 2008 SP2.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Arkon

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS10-098 (KB2436673):
http://www.microsoft.com/technet/security/bulletin/ms10-098.mspx

Arkon:
http://www.ragestorm.net/blogs/?p=255

Other references
Further details available to Secunia VIM customers

Technical Analysis
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers