53666 : Microsoft Windows Management Instrumentation (WMI) Service Isolation Local Privilege Escalation
Printer | http://osvdb.org/53666 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
4	1524	over 2 years ago	about 1 year ago	6 times	40%

This Entry needs help! It is only 40% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Timeline

Disclosure Date	Vendor Solution Date
2009-04-14	2009-04-14

Description

<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-0078" target="_blank">CVE</a>)</em> : The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows WMI Service Isolation Vulnerability."

Classification

Solution: Patch / RCS
Disclosure: Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Unknown or Incomplete

References

CVE ID: 2009-0078 (see also: NVD)
Related OSVDB ID: 53667 53668
Microsoft Knowledge Base Article: 959454
News Article: http://gcn.com/articles/2009/04/15/microsoft-april-security-patch.aspx
http://www.eweek.com/c/a/Security/Micrsoft-Patch-Tuesday-Plugs-Security-Holes-as-Hackers-Circle-317813/
Microsoft Security Bulletin: MS09-012

Tools & Filters

	36150

Credit

Cesar Cerrudo - Argeniss

CVSSv2 Score

CVSSv2 Base Score = 7.2
Source: nvd.nist.gov | Generated: 2009-04-15 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

2009/04/18 22:29:00 | MS09-012 and ISA Server Standard Edition 14109 Failures

from: Forefront TMG (ISA Server) Product Team Blog

We've received several reports of ISA Server Standard Edition restart failures after installation of last week's security updates ... (MBE) The problem occurs when you install the MS09-012 patch under very specific circumstances ... for the MS09-012 bulletin articles and will post that as soon as it's ready. In the meantime, you can employ

2009/04/29 09:57:00 | [MS Security Bulletins] Major Revisions - Issued: April 29, 2009

from: Cliff Hobbs - FAQShop.com and Microsoft MVP ConfigMgr/ SMS

Summary ======= The following bulletins have undergone a major revision increment. Please see the appropriate bulletin for more details. * MS09-012 - Important * MS08-076 - Important * MS08-069 - Critical Bulletin Information: * MS09-012

2009/04/30 14:02:11 | Microsoft Revises 08-069, 08-076, and 09-012, (Thu, Apr 30th)

from: SANS Internet Storm Center, InfoCON: green

Microsoft has issued major revisions to the following security bulletins: * MS09-012 - Impor ...(more)...

2009/04/22 08:00:00 | MS09-012 - Important: Vulnerabilities in Windows Could Allow Elevation of Privilege (959454) - Version:1.2

from: Microsoft Patch Watch

Severity Rating: Important - Revision Note: V1.2 (April 22, 2009): Added entry to the section, Frequently Asked Questions (FAQ) ... is allowed to log on to the system and then run a specially crafted application. MS09-012

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.