Severity: : High
  CVE Kennungen: : CVE-2011-0030
  Advisory Date: 10 de lutego de 2011

  DESCRIPTION

This security update addresses a vulnerability in the Microsoft Windows Client/Server Run-time Subsystem (CSRSS), which could allow elevation of privilege. The exploit works if an attacker logs on to a user's system and starts a specially crafted application that continues running after the attacker logs off in order to obtain the logon credentials of subsequent users. However, an attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. It cannot be exploited anonymously nor remotely. More specifically, this update addresses the vulnerability by correcting the manner in which user processes are terminated upon logoff.

  INFORMATION EXPOSURE

For information on patches specific to the affected software, please proceed to the Microsoft Web page.

  AFFECTED SOFTWARE AND VERSION:

  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems