=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN223
_____________________________________________________________________

DATE                : 15/10/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2003, Vista, Server 2008,
                      running FAT32 Disk Partition Driver.

======================================================================
https://technet.microsoft.com/library/security/ms14-063
______________________________________________________________________

MS14-063 Vulnerability in FAT32 Disk Partition Driver Could Allow
Elevation of Privilege

Version: 1.0

Published Date: October 14, 2014

General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. An elevation of privilege vulnerability exists in
the way the Windows FASTFAT system driver interacts with FAT32 disk
partitions. An attacker who successfully exploited this vulnerability
could execute arbitrary code with elevated privileges.

This security update is rated Important for all supported editions of
Windows Server 2003, Windows Vista, and Windows Server 2008.


Affected Software

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)


Vulnerability Information

Windows Disk Partition Driver Elevation of Privilege Vulnerability
CVE-2014-4115

An elevation of privilege vulnerability exists in the way the Windows
FASTFAT system driver interacts with FAT32 disk partitions. An attacker
who successfully exploited this vulnerability could execute arbitrary
code with elevated privileges.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2014-4115.

An attacker must have physical access to the system to be able to
exploit the vulnerability.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================