=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN391
_____________________________________________________________________

DATE                : 11/09/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version 7, Server 2008.

======================================================================
KB2872339
http://technet.microsoft.com/en-us/security/bulletin/ms13-077
______________________________________________________________________

Microsoft Security Bulletin MS13-077 - Important Vulnerability in
Windows Service Control Manager Could Allow Elevation of Privilege (2872339)

Published Date: September 10, 2013

Version: 1.0


General Information


Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow elevation of privilege
if convinces an authenticated user to execute a specially crafted
application. To exploit this vulnerability, an attacker either must
have valid logon credentials and be able to log on locally or must
convince a user to run the attacker's specially crafted application.

This security update is rated Important for all supported editions of
Windows 7 and Windows Server 2008 R2.


Affected Software

Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)


Vulnerability Information

Service Control Manager Double Free Vulnerability - CVE-2013-3862

An elevation of privilege vulnerability exists in the way that the
Windows Service Control Manager (SCM) handles objects in memory. An
attacker who successfully exploited this vulnerability could execute
arbitrary code and take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================