Multiple vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

1) An error in the "AllocConsole()" function within the Client/Server Run-time Subsystem (CSRSS) when multiple console objects are associated with a process can be exploited to cause a new process to obtain an orphaned object after the original process terminates.

2) An input validation error in the "SrvSetConsoleLocalEUDC()" function within the Client/Server Run-time Subsystem (CSRSS) can be exploited to write certain data into a NULL page.

3) An array-indexing error in the "SrvSetConsoleNumberOfCommand()" function within the Client/Server Run-time Subsystem (CSRSS) can be exploited to read data from certain kernel memory locations.

4) An integer overflow error in the "SrvWriteConsoleOutput()" function within the Client/Server Run-time Subsystem (CSRSS) can be exploited to corrupt memory.

5) An integer overflow error in the "SrvWriteConsoleOutputString()" function within the Client/Server Run-time Subsystem (CSRSS) can be exploited to corrupt memory.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Matthew 'j00ru' Jurczyk

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS11-056 (KB2507938):
http://www.microsoft.com/technet/security/Bulletin/MS11-056.mspx

j00ru:
http://j00ru.vexillium.org/?p=893

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers