Vulnerability CVE-2010-1735 - CERT Civis.Net

Vulnerability Name:

CVE-2010-1735 (CCN-58059)

Assigned:

2010-04-22

Published:

2010-04-22

Updated:

2021-07-07

Summary:

The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.

CVSS v3 Severity:

6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

4.9 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
3.9 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
3.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2010-1735

Source: CCN
Type: SA39456
Microsoft Windows SfnLOGONNOTIFY() and SfnINSTRING() Denial of Service

Source: SECUNIA
Type: Vendor Advisory
39456

Source: MISC
Type: Exploit
http://vigilance.fr/vulnerability/Windows-denials-of-service-of-win32k-sys-9607

Source: CCN
Type: Microsoft Web site
Microsft Windows

Source: CCN
Type: OSVDB ID: 64057
Microsoft Windows win32k.sys Driver SfnLOGONNOTIFY() Function Local Privilege Escalation

Source: BUGTRAQ
Type: UNKNOWN
20100422 Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability

Source: BID
Type: Exploit
39630

Source: CCN
Type: BID-39630
Microsoft Windows 'SfnLOGONNOTIFY' Local Privilege Escalation Vulnerability

Source: XF
Type: UNKNOWN
win-sfnlogonnotify-dos(58059)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [04-22-2010]

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_2000:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:gold:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp1:*:*:home:*:x86:*

OR cpe:/o:microsoft:windows_xp:-:sp2:*:*:home:*:x86:*

OR cpe:/o:microsoft:windows_xp:*:*:x86:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:gold:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:professional:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp3:x86:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:gold:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:rc2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:beta3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:gold:64-bit-2002:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:home:*:x86:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:media_center:*:x86:*

OR cpe:/o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:gold:tablet_pc:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:embedded:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:r2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:gold:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:gold:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:gold:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:embedded:*:x86:*

OR cpe:/o:microsoft:windows_xp:*:gold:embedded:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:gold:media_center:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:sp3:unknown:english:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:rc1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:gold:64-bit-2003:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:-:*:*:home:*:x86:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:professional:*:x86:*

OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:tablet_pc:*:x86:*

OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:embedded:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:professional:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:x86:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*

OR cpe:/a:microsoft:windows_2003:*:*:*:*:*:*:*:*

Denotes that component is vulnerable