MS Windows XP CVE-2013-5065 Eleventh zero-day flaw found by FireEye

FireEye Security Experts discovered Microsoft Windows XP and Server 2003 privilege escalation zero-day exploit

Security experts at FireEye have discovered a new zero-day, a privilege escalation vulnerability in Windows XP and Windows Server 2003.

It’s is the eleventh vulnerability discovered by FireEye this year, really a great job for the researchers of the young company. The last zero-day flaw is coded by Microsoft as CVE-2013-5065, it is a privilege escalation vulnerability that is combined by hackers with another exploit in Adobe Reader (CVE-2013-3346).

Microsoft has issued a security advisory (2914486) informing the customers that Windows Kernel could allow elevation of privilege to attackers due the exploit of a bug in Windows XP’s NDPROXY.SYS driver.

“We are aware of limited, targeted attacks that attempt to exploit this vulnerability. Our investigation of this vulnerability has verified that it does not affect customers who are using operating systems newer than Windows XP and Windows Server 2003.” reported Microsoft.

Hackers could exploit the flaw to execute arbitrary code in the system’s kernel running it from a standard user account, be aware the vulnerability cannot be used for remote code execution.

“An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users” states the advisory.

The attacker once elevated his privileges is able to conduct various activities, including accessing or deleting data, installing programs or creating accounts with administrative privileges.

It must be considered that on April 10, 2012, Microsoft announced that extended support for Windows XP and Office 2003 would end on April 8, 2014 and suggested that administrators begin preparing to migrate to a newer OS. This means that XP systems will no longer receive security updates provided by Microsoft … a good reason to upgrade the OS.