Just for info, for those others who work in securty, here's another zero-day... I make that 4 MS-related ones so far for December
http://www.frsirt.com/english/advisories/2006/5120
Advisory ID : FrSIRT/ADV-2006-5120
CVE ID : CVE-2006-6696
Rated as : Moderate Risk
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2006-12-22
Technical Description
A vulnerability has been identified in Microsoft Windows, which could be exploited by local attackers to obtain elevated privileges. This issue is due to a double-free error within the Windows Server Library (WINSRV.DLL) and the Client Server Run-Time Subsystem (CSRSS) when calling a MessageBox API with malformed parameters and a "MB_SERVICE_NOTIFICATION" flag set, which could allow malicious users to crash a vulnerable system or execute arbitrary commands with SYSTEM privileges.
Affected Products
Microsoft Windows Vista Home
Microsoft Windows Vista Business
Microsoft Windows Vista Enterprise
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 1
Microsoft Windows Server 2003 Service Pack 1
Solution
The FrSIRT is not aware of any official supplied patch for this issue.
Join CF
You are here: 
