=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN057
_____________________________________________________________________

DATE                : 13/02/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Windows version XP, Server 2003, Vista, 7, 8, RT,
            Server 2008, Server 2012 running Windows Kernel-Mode Driver.

======================================================================
KB2778344
http://technet.microsoft.com/en-us/security/bulletin/MS13-016
______________________________________________________________________

Microsoft Security Bulletin MS13-016 - Important Vulnerabilities in
Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778344)

Published Date: February 12, 2013

Version: 1.0


General Information

Executive Summary

This security update resolves 30 privately reported vulnerabilities in
Microsoft Windows. The vulnerabilities could allow elevation of
privilege if an attacker logs on to the system and runs a specially
crafted application. An attacker must have valid logon credentials and
be able to log on locally to exploit the vulnerabilities.

This security update is rated Important for all supported releases of
Microsoft Windows except Windows 8, Windows Server 2012, and Windows RT.


Affected Software

Windows XP Service Pack 3 (KB2799494)
Windows XP Professional x64 Edition Service Pack 2 (KB2799494)
Windows Server 2003 Service Pack 2 (KB2799494)
Windows Server 2003 x64 Edition Service Pack 2 (KB2799494)
Windows Server 2003 with SP2 for Itanium-based Systems (KB2799494)
Windows Vista Service Pack 2 (KB2799494)
Windows Vista x64 Edition Service Pack 2 (KB 2799494)
Windows Server 2008 for 32-bit Systems Service Pack 2 (KB2799494)
Windows Server 2008 for x64-based Systems Service Pack 2 (KB2799494)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (KB2799494)
Windows 7 for 32-bit Systems (KB2799494)
Windows 7 for 32-bit Systems Service Pack 1 (KB2799494)
Windows 7 for x64-based Systems (KB2799494)
Windows 7 for x64-based Systems Service Pack 1 (KB2799494)
Windows Server 2008 R2 for x64-based Systems (KB2799494)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (KB2799494)
Windows Server 2008 R2 for Itanium-based Systems (KB2799494)
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (KB2799494)
Windows 8 for 32-bit Systems (KB2799494)
Windows 8 for 64-bit Systems (KB2799494)
Windows Server 2012 (KB2799494)
Windows RT (KB2799494
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation) (KB2799494)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation) (KB2799494)
Windows Server 2008 R2 for x64-based Systems (Server Core installation)
(KB2799494)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation) (KB2799494)
Windows Server 2012 (Server Core installation) (KB2799494)


Vulnerability Information

Win32k Race Condition Vulnerabilities

Elevation of privilege vulnerabilities exist when the Windows
kernel-mode driver improperly handles objects in memory. An attacker
who successfully exploited these vulnerabilities could gain elevated
privileges and read arbitrary amounts of kernel memory.

To view these vulnerabilities as standard entries in the Common
Vulnerabilities and Exposures list, see the following:

CVE-2013-1248
CVE-2013-1249
CVE-2013-1250
CVE-2013-1251
CVE-2013-1252
CVE-2013-1253
CVE-2013-1254
CVE-2013-1255
CVE-2013-1256
CVE-2013-1257
CVE-2013-1258
CVE-2013-1259
CVE-2013-1260
CVE-2013-1261
CVE-2013-1262
CVE-2013-1263
CVE-2013-1264
CVE-2013-1265
CVE-2013-1266
CVE-2013-1267
CVE-2013-1268
CVE-2013-1269
CVE-2013-1270
CVE-2013-1271
CVE-2013-1272
CVE-2013-1273
CVE-2013-1274
CVE-2013-1275
CVE-2013-1276
CVE-2013-1277

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================