Microsoft Windows Privilege Escalation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03

[ Description ]Official description

The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.

CISA: A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

• Patch on kb.cert.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on us-cert.govVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.kb.cert.org/vuls/id/647436PatchThird Party AdvisoryUS Government Resource
• www.us-cert.gov/cas/techalerts/TA04-196A.htmlBroken LinkPatchThird Party Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-020PatchVendor Advisory
• exchange.xforce.ibmcloud.com/vulnerabilities/16590Third Party AdvisoryVDB Entry
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2166Broken Link
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2847Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource