CVE-2013-3660

KEV

Published: Mag 24, 2013 Last Modified: Ott 22, 2025

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 7,8

Source: [email protected]

Attack Vector: local

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

MEDIUM 6,9

Source: [email protected]

Access Vector: local

Access Complexity: medium

Authentication: none

Confidentiality: complete

Integrity: complete

Availability: complete

Description

AI Translation Available

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka 'Win32k Read AV Vulnerability.'

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,6919

Percentile

1,0th

Updated

EPSS Score Trend (Last 90 Days)

119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stable

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Confidentiality Availability

Potential Impacts:

Execute Unauthorized Code Or Commands Modify Memory Read Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory)

Applicable Platforms

Languages: Assembly, C, C++, Memory-Unsafe

Likelihood of Exploit: High

View CWE Details

Exploit

Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase

Verified

Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase

Author: Tavis Ormandy Published: Status: Verified

View Exploit Code →

Exploit

Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring

Verified

Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring

Author: Tavis Ormandy Published: Status: Verified

View Exploit Code →

Exploit

Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)

Verified Metasploit Framework (MSF)

Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)

Author: Metasploit Published: Status: Verified

View Exploit Code →

Operating System

Windows 8 by Microsoft

Product Information

Vendor Microsoft

Product Windows 8

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2003 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2003

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2008 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2008

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2012 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2012

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Rt by Microsoft

Product Information

Vendor Microsoft

Product Windows Rt

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2008 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2008

Version r2

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Vista by Microsoft

Product Information

Vendor Microsoft

Product Windows Vista

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows 7 by Microsoft

Product Information

Vendor Microsoft

Product Windows 7

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Xp by Microsoft

Product Information

Vendor Microsoft

Product Windows Xp

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Xp by Microsoft

Product Information

Vendor Microsoft

Product Windows Xp

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

https://www.cisa.gov/known-exploited-vulnerabilities-catalo…

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013…

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html

https://docs.microsoft.com/en-us/security-updates/securityb…

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-0…

http://secunia.com/advisories/53435

https://oval.cisecurity.org/repository/search/definition/ov…

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…

http://twitter.com/taviso/statuses/309157606247768064

http://twitter.com/taviso/statuses/335557286657400832

http://www.computerworld.com/s/article/9239477

http://www.exploit-db.com/exploits/25611/

http://www.osvdb.org/93539

http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows…

http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vul…

http://www.theverge.com/2013/5/23/4358400/google-engineer-b…

http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-disc…

http://www.us-cert.gov/ncas/alerts/TA13-190A

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-…

http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html

https://docs.microsoft.com/en-us/security-updates/securityb…

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-0…

http://secunia.com/advisories/53435

https://oval.cisecurity.org/repository/search/definition/ov…

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…

http://twitter.com/taviso/statuses/309157606247768064

http://twitter.com/taviso/statuses/335557286657400832

http://www.computerworld.com/s/article/9239477

http://www.exploit-db.com/exploits/25611/

http://www.osvdb.org/93539

http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows…

http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vul…

http://www.theverge.com/2013/5/23/4358400/google-engineer-b…

http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-disc…

http://www.us-cert.gov/ncas/alerts/TA13-190A

CVE-2013-3660

Description

EPSS (Exploit Prediction Scoring System)

EPSS (Exploit Prediction Scoring System)

EPSS Score Trend (Last 90 Days)

Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Consequences

Applicable Platforms

Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase

Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring

Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)

Windows 8 by Microsoft

Product Information

Windows Server 2003 by Microsoft

Product Information

Windows Server 2008 by Microsoft

Product Information

Windows Server 2012 by Microsoft

Product Information

Windows Rt by Microsoft

Product Information

Windows Server 2008 by Microsoft

Product Information

Windows Vista by Microsoft

Product Information

Windows 7 by Microsoft

Product Information

Windows Xp by Microsoft

Product Information

Windows Xp by Microsoft

Product Information

Iscriviti alla newsletter