certfr_alerte - certa-2013-ale-008

CERTA-2013-ALE-008

Vulnerability from certfr_alerte

Une vulnérabilité a été découverte dans le noyau de Microsoft Windows. Elle permet à un attaquant de provoquer une élévation de privilèges. La vulnérabilité concerne le driver NDPROXY qui permet l'interface entre les drivers NDISWAN et CoNDIS WAN avec les services TAPI.
Seuls Windows XP et Windows Server 2003 sont impactés par cette vulnérabilité. Microsoft a planifié l'arrêt du support de Microsoft Windows XP en avril 2014, le CERTA encourage donc l'utilisation des dernières versions supportées des produits Microsoft.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation)

None

Impacted products

Vendor	Product	Description
Microsoft	Windows	Windows Server 2003 x64 Edition Service Pack 2
Microsoft	Windows	Windows Server 2003 Service Pack 2
Microsoft	Windows	Windows XP Service Pack 3
Microsoft	Windows	Windows Server 2003 avec SP2 pour les systèmes basés sur Itanium
Microsoft	Windows	Windows XP Professional x64 Edition Service Pack 2

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft 2914486 du 27 novembre 2013	None	vendor-advisory
Bulletin de sécurité Microsoft MS14-002 du 14 janvier 2014	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2003 x64 Edition Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows XP Service Pack 3",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 avec SP2 pour les syst\u00e8mes bas\u00e9s sur Itanium",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows XP Professional x64 Edition Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2014-01-16",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation)\n",
  "cves": [
    {
      "name": "CVE-2013-5065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-5065"
    }
  ],
  "initial_release_date": "2013-11-28T00:00:00",
  "last_revision_date": "2014-01-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS14-002 du 14 janvier 2014",
      "url": "http://technet.microsoft.com/en-us/security/bulletin/ms14-002"
    }
  ],
  "reference": "CERTA-2013-ALE-008",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-11-28T00:00:00.000000"
    },
    {
      "description": "fermeture de l\u0027alerte, suite \u00e0 la diffusion du correctif par l\u0027\u00e9diteur.",
      "revision_date": "2014-01-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le noyau de \u003cspan\nclass=\"textit\"\u003eMicrosoft Windows\u003c/span\u003e. Elle permet \u00e0 un attaquant de\nprovoquer une \u00e9l\u00e9vation de privil\u00e8ges. La vuln\u00e9rabilit\u00e9 concerne le\ndriver NDPROXY qui permet l\u0027interface entre les drivers \u003cspan\nclass=\"textit\"\u003eNDISWAN\u003c/span\u003e et \u003cspan class=\"textit\"\u003eCoNDIS WAN\u003c/span\u003e\navec les services \u003cspan class=\"textit\"\u003eTAPI\u003c/span\u003e.  \nSeuls \u003cspan class=\"textit\"\u003eWindows XP\u003c/span\u003e et \u003cspan\nclass=\"textit\"\u003eWindows Server 2003\u003c/span\u003e sont impact\u00e9s par cette\nvuln\u00e9rabilit\u00e9. \u003cspan class=\"textit\"\u003eMicrosoft\u003c/span\u003e a planifi\u00e9 l\u0027arr\u00eat\ndu support de \u003cspan class=\"textit\"\u003eMicrosoft Windows XP\u003c/span\u003e en avril\n2014, le CERTA encourage donc l\u0027utilisation des derni\u00e8res versions\nsupport\u00e9es des produits Microsoft.\n",
  "title": "Vuln\u00e9rabilit\u00e9 critique dans le noyau de Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 2914486 du 27 novembre 2013",
      "url": "http://technet.microsoft.com/en-us/security/advisory/2914486"
    }
  ]
}

CVE-2013-5065 (GCVE-0-2013-5065)

Vulnerability from cvelistv5

Published

2013-11-27 23:00

Modified

2025-10-22 00:05

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

References

URL

Tags

	http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html	x_refsource_MISC
	https://www.exploit-db.com/exploits/37732/	exploit, x_refsource_EXPLOIT-DB
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002	vendor-advisory, x_refsource_MS
	http://technet.microsoft.com/security/advisory/2914486	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:59:41.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html"
          },
          {
            "name": "37732",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/37732/"
          },
          {
            "name": "MS14-002",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://technet.microsoft.com/security/advisory/2914486"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2013-5065",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T19:21:27.526192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5065"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-22T00:05:39.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5065"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-03T00:00:00+00:00",
            "value": "CVE-2013-5065 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html"
        },
        {
          "name": "37732",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/37732/"
        },
        {
          "name": "MS14-002",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://technet.microsoft.com/security/advisory/2914486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2013-5065",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html",
              "refsource": "MISC",
              "url": "http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html"
            },
            {
              "name": "37732",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/37732/"
            },
            {
              "name": "MS14-002",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002"
            },
            {
              "name": "http://technet.microsoft.com/security/advisory/2914486",
              "refsource": "CONFIRM",
              "url": "http://technet.microsoft.com/security/advisory/2914486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2013-5065",
    "datePublished": "2013-11-27T23:00:00.000Z",
    "dateReserved": "2013-08-06T00:00:00.000Z",
    "dateUpdated": "2025-10-22T00:05:39.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2013-ALE-008

Vulnerability from certfr_alerte

Solution

CVE-2013-5065 (GCVE-0-2013-5065)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature