=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN545
_____________________________________________________________________

DATE                : 11/12/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version XP, Server 2003, Vista,
                         Server 2008, 7, 8, RT, Server 2012
                     running Windows Kernel-Mode Drivers.

======================================================================
KB2880430
https://technet.microsoft.com/en-us/security/bulletin/ms13-101
______________________________________________________________________

Microsoft Security Bulletin MS13-101 - Important Vulnerabilities in
Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430)

Published Date: December 10, 2013

Version: 1.0


General Information

Executive Summary

This security update resolves five privately reported vulnerabilities
in Microsoft Windows. The more severe of these vulnerabilities could
allow elevation of privilege if an attacker logs on to a system and
runs a specially crafted application. An attacker must have valid logon
credentials and be able to log on locally to exploit this vulnerability.

This security update is rated Important for all supported releases of
Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008,
Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and
Windows RT, and Moderate for Windows 8.1, Windows Server 2012 R2, and
Windows RT 8.1. For more information, see the subsection, Affected and
Non-Affected Software, in this section.


Affected Software

Windows XP Service Pack 3 		
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2			
Windows Server 2003 x64 Edition Service Pack 2 		
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2 	
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 			
Windows Server 2008 for 32-bit Systems Service Pack 2 	
Windows Server 2008 for x64-based Systems Service Pack 2 	
Windows Server 2008 for x64-based Systems Service Pack 2 	
Windows Server 2008 for Itanium-based Systems Service Pack 2 	
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1 	
Windows 7 for 32-bit Systems Service Pack 1 	
Windows 7 for x64-based Systems Service Pack 1 	
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 	
Windows Server 2008 R2 for x64-based Systems Service Pack 1 		
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 		
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems 	
Windows 8 for 32-bit Systems 		
Windows 8 for x64-based Systems 		
Windows 8 for x64-based Systems 		
Windows 8.1 for 32-bit Systems 		
Windows 8.1 for x64-based Systems
Windows Server 2012 		
Windows Server 2012 		
Windows Server 2012 R2
Windows RT [1] 		
Windows RT [1] 		
Windows RT 8.1 [1]
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
  installation)		
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
  installation)		
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server
Core installation)		
Windows Server 2012 (server core installation)		
Windows Server 2012 R2 (server core installation)

[1] This update is available via Windows Update. 			


Vulnerability Information

Win32k Integer Overflow Vulnerability - CVE-2013-3899

An elevation of privilege vulnerability exists in the way that the
Win32k.sys kernel-mode driver validates address values in memory. An
attacker who successfully exploited this vulnerability could execute
arbitrary code with elevated privileges.

Win32k Use After Free Vulnerability - CVE-2013-3902

An elevation of privilege vulnerability exists in the Microsoft Windows
kernel. This vulnerability is caused when the Windows kernel improperly
handles objects in memory. An attacker who successfully exploited this
vulnerability could execute arbitrary code in kernel mode. An attacker
could then install programs; view, change, or delete data; or create new
accounts with full administrative rights.

TrueType Font Parsing Vulnerability - CVE-2013-3903

A denial of service vulnerability exists in the Microsoft Windows
kernel. This vulnerability is caused when the Windows kernel improperly
processes a specifically crafted TrueType font file. An attacker who
successfully exploited this vulnerability could cause the affected
system to stop responding and restart.

Port-Class Driver Double Fetch Vulnerability - CVE-2013-3907

An elevation of privilege vulnerability exists in the way that the
Windows audio port-class driver (portcls.sys) handles objects in
memory. An attacker who successfully exploited this vulnerability could
execute arbitrary code with elevated privileges.

Win32k Integer Overflow Vulnerability - CVE-2013-5058

An denial of service vulnerability exists in the way that the
Win32k.sys kernel-mode driver handles objects in memory. An attacker
who successfully exploited this vulnerability could cause the target
system to stop responding.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================