Privilege escalation in Microsoft Windows and Windows Server - CVE-2013-5065

Vulnerability identifier: #VU4348

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-5065

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper validation of input by the NDProxy.sys kernel component. A local attacker with valid login credentials can use a malicious application to gain kernel privileges and execute arbitrary code on the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Microsoft Windows
Windows Server

Install update from vendor's website.

• Exploit #2109 - RobbinHood (# NDPROXY Local SYSTEM privilege escalation # http://www.offensive-security.com # Tested on Windows XP SP3 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/     # Original crash ... null pointer dereferenc (March 18, 2020)
• Exploit #761 - Microsoft Windows XP SP3 x86 / 2003 SP2 (x86) - 'NDProxy' Privilege Escalation (MS14-002) (March 18, 2020)
• Exploit #762 - Microsoft Windows - 'ndproxy.sys' - Privilege Escalation (Metasploit) (March 18, 2020)
• Exploit #763 - Microsoft Windows - 'NDPROXY' Local SYSTEM Privilege Escalation (MS14-002) (March 18, 2020)
• Exploit #1604 - MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms14-002

• Privilege escalation in Microsoft Windows