Intrusion PreventionMS.Windows.Workstation.Service.Memory.Corruption
Description
This indicates a possible attempt to exploit a vulnerability in Windows Workstation Service.
The vulnerability could allow elevation of privilege if an attacker created a specially crafted RPC message and sent the message to an affected system. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
The security update resolves a privately reported vulnerability in the Windows Workstation Service. It addresses the vulnerability by correcting the manner in which the Workstation service allocates and frees memory.
Affected Products
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2*
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2*
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Impact
Privilege escalation: Remote attackers can gain elevated privileges.
Recommended Actions
Apply the patch, available from the vendor's website:
http://www.microsoft.com/technet/security/Bulletin/MS09-041.mspx
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 29118 |
| Created | Sep 19, 2011 |
| Updated | Apr 23, 2014 |
| Risk |
|
| CVE ID | CVE-2009-1544 |
| Exploit Prediction Score | 82.39% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |