Windows Security Update Targets Elevation of Privilege Attacks

Microsoft is continuing its investigation into a vulnerability that could allow hackers to gain superuser privileges on various flavors of the Windows OS.

Microsoft this week is continuing its ongoing investigation into what it calls "new public reports" of a vulnerability that could allow hackers to gain superuser privileges through LocalSystem in Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.

Redmond late last week issued a Security Advisory adding Windows XP Professional Service Pack 3 to the list of affected software. The advisory provides IT pros with some guidance and workarounds to help avoid a vulnerability that may allow elevation-of-privilege attacks.

The software giant said it is considering other actions, including the provision of a "security update" via its monthly Patch Tuesday security rollout.

This latest update involves a highly technical attack vector similar in scope to a patch released in last April's slate, where a local privilege-escalation vulnerability affected the Windows kernel due to improper validation of user-mode input. In the same manner, with this advisory, an attacker who has gained local access can change user parameters and exploit this issue to execute code with elevated permissions.

Microsoft said in its advisory that administrators that allow customized code to "run in an authenticated context, such as within Internet Information Services (IIS) and SQL Server," should take a look at the advisory.

Off-site server hosting providers running Windows programs may also face increased risk, Microsoft added.

Potential workarounds include log-in and process monitoring specifically in Internet Information Services. Administrators can do this by creating a Worker Process Identity through the ISS manager function in Windows. The same can be done in SQL Server with the database administrator keeping track of users and changes to fields and access privileges.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Exchange Server June Cumulative Updates Arrive, But with Red Tape

    Microsoft released its quarterly cumulative updates (CUs) for Exchange Server 2013, 2016 and 2019 products this week, but added an extra step for IT pros to consider before installing them.

  • Moving an Old VM to a New Hyper-V Host

    So you want to know whether a Hyper-V virtual machine built on a legacy host will be supported by a newer server? There's a PowerShell command for that.

  • AI-Driven Solution Tracks Packets Through the Datacenter

    Datacenter solutions vendor Kaloom this week unveiled a new offering the company says will enable the development of "self-driving" datacenter networks.

  • Microsoft Previews Azure Bastion Service for Private VM Access

    Microsoft on Tuesday announced a preview of the Azure Bastion service, which lets a user connect to an Azure virtual machine (VM) using a private Internet connection.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.