Published: 24/05/2013 Updated: 26/02/2019

CVSS v2 Base Score: 4.9 | Impact Score: 6.9 | Exploitability Score: 3.9

VMScore: 505

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows xp -
microsoft windows 7 -
microsoft windows 8 -
microsoft windows vista -
microsoft windows server 2008 -
microsoft windows rt -
microsoft windows xp
microsoft windows server 2003
microsoft windows server 2012 -
microsoft windows server 2008 r2

#ifndef WIN32_NO_STATUS # define WIN32_NO_STATUS #endif #include <stdioh> #include <stdargh> #include <stddefh> #include <windowsh> #include <asserth> #ifdef WIN32_NO_STATUS # undef WIN32_NO_STATUS #endif #include <ntstatush> #pragma comment(lib, "gdi32") #pragma comment(lib, "kernel32") #pragma comment(li ...

I'm quite proud of this list cycle trick, here's how to turn it into an arbitrary write First, we create a watchdog thread that will patch the list atomically when we're ready This is needed because we can't exploit the bug while HeavyAllocPool is failing, because of the early exit in pprFlattenRec: text:BFA122B8 call newpathre ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'm ...

CWE-22 http://secunia.com/advisories/53435 http://www.computerworld.com/s/article/9239477 http://twitter.com/taviso/statuses/335557286657400832 http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw http://www.exploit-db.com/exploits/25611/http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/http://www.osvdb.org/93539 http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html https://nvd.nist.gov https://www.exploit-db.com/exploits/25912/

CVE-2013-3661

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect