====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN400
____________________________________________________________________

DATE                : 10/10/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Windows XP, Server 2003, Vista, Server 2008, 7.

======================================================================
KB2724197
http://technet.microsoft.com/en-us/security/bulletin/MS12-068
______________________________________________________________________

Microsoft Security Bulletin MS12-068 - Important Vulnerability in
Windows Kernel Could Allow Elevation of Privilege (2724197)

Published Date: October 9, 2012

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in all
supported releases of Microsoft Windows except Windows 8 and Windows
Server 2012.

This security update is rated Important for all supported editions of
Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008,
Windows 7, and Windows Server 2008 R2. For more information, see the
subsection, Affected and Non-Affected Software, in this section.

The vulnerability could allow elevation of privilege if an attacker
logs on to the system and runs a specially crafted application. An
attacker must have valid logon credentials and be able to log on
locally to exploit this vulnerability.


Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
 installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
 installation)
Windows Server 2008 R2 for x64-based Systems (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)


Vulnerability Information

Windows Kernel Integer Overflow Vulnerability - CVE-2012-2529

An elevation of privilege vulnerability exists when the Windows kernel
improperly handles objects in memory. An attacker who successfully
exploited this vulnerability could run arbitrary code in kernel mode. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full administrative rights.


======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================