Vulnerability Name:

CVE-2010-0232 (CCN-55742)

Assigned:2010-01-19
Published:2010-01-19
Updated:2019-02-26
Summary:The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB), and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem, leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D), aka "Windows Kernel Exception Handler Vulnerability."
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.9 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.9 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-264
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: Full-Disclosure Mailing List, Tue Jan 19 2010
Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack

Source: CONFIRM
Type: UNKNOWN
http://blogs.technet.com/msrc/archive/2010/01/20/security-advisory-979682-released.aspx

Source: MITRE
Type: CNA
CVE-2010-0232

Source: MLIST
Type: UNKNOWN
[dailydave] 20100119 We hold these axioms to be self evident

Source: MISC
Type: Exploit
http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip

Source: FULLDISC
Type: UNKNOWN
20100119 Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack

Source: CCN
Type: SA38265
Microsoft Windows "KiTrap0D" Privilege Escalation Vulnerability

Source: SECUNIA
Type: Vendor Advisory
38265

Source: CCN
Type: SECTRACK ID: 1023471
Windows Kernel #GP Trap Handler Flaw Lets Local Users Gain Elevated Privileges

Source: SECTRACK
Type: UNKNOWN
1023471

Source: CCN
Type: Microsoft Security Bulletin MS11-098
Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2633171)

Source: CCN
Type: Microsoft Security Bulletin MS12-042
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.microsoft.com/technet/security/advisory/979682.mspx

Source: CCN
Type: Microsoft Security Bulletin MS10-015
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165)

Source: CCN
Type: Microsoft Security Bulletin MS10-021
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (979683)

Source: CCN
Type: Microsoft Security Bulletin MS10-047
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852)

Source: CCN
Type: Microsoft Security Bulletin MS11-011
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802)

Source: CCN
Type: Microsoft Web site
Microsoft Windows

Source: BUGTRAQ
Type: UNKNOWN
20100119 Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack

Source: BID
Type: Exploit
37864

Source: CCN
Type: BID-37864
Microsoft Windows #GP Trap Handler Local Privilege Escalation Vulnerability

Source: CERT
Type: US Government Resource
TA10-040A

Source: VUPEN
Type: Vendor Advisory
ADV-2010-0179

Source: MS
Type: UNKNOWN
MS10-015

Source: XF
Type: UNKNOWN
ms-win-gptrap-privilege-escalation(55742)

Source: XF
Type: UNKNOWN
ms-win-gptrap-privilege-escalation(55742)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:8344

Source: CCN
Type: Packet Storm Security [11-14-2013]
Windows SYSTEM Escalation Via KiTrap0D

Source: CCN
Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY
KNOWN EXPLOITED VULNERABILITIES CATALOG

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows_2000:sp4:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:sp1:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:sp2:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:windows_nt:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:*:sp2:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista::sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:::x32:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:8344
    V
    		Windows Kernel Exception Handler Vulnerability
    2010-03-22
    BACK
    microsoft windows 2000 sp4
    microsoft windows 7 -
    microsoft windows nt 3.1
    microsoft windows server 2003 * sp2
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 sp2 x32
    microsoft windows vista *
    microsoft windows vista *
    microsoft windows vista * sp1
    microsoft windows vista * sp2
    microsoft windows vista sp1
    microsoft windows vista sp2
    microsoft windows xp -
    microsoft windows xp - sp2
    microsoft windows xp sp3
    microsoft windows nt 4.0
    microsoft windows 2000 sp4
    microsoft windows xp sp2
    microsoft windows vista
    microsoft windows server_2003
    microsoft windows nt 3.1
    microsoft windows vista sp1
    microsoft windows xp sp3
    microsoft windows vista sp2
    microsoft windows 7