CVEvulnerability
CVE-2007-1209
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-04-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-399
Description
Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multiple ApiPort connections, which leaves a "dangling pointer" to a process data structure.
Affected configurations
• microsoft windows vista
Related
Weakness · not in database (1)
References
- http://research.eeye.com/html/advisories/published/AD20070410b.html research.eeye.com
- http://secunia.com/advisories/24823 secunia.com
- http://securityreason.com/securityalert/2531 securityreason.com
- http://www.kb.cert.org/vuls/id/219848 US Government Resource
- http://www.osvdb.org/34008 www.osvdb.org
- http://www.securityfocus.com/archive/1/465233/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/466331/100/200/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/23338 www.securityfocus.com
- http://www.securitytracker.com/id?1017897 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA07-100A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/1325 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-021 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1524 oval.cisecurity.org
- http://research.eeye.com/html/advisories/published/AD20070410b.html research.eeye.com
- http://secunia.com/advisories/24823 secunia.com
- http://securityreason.com/securityalert/2531 securityreason.com
- http://www.kb.cert.org/vuls/id/219848 US Government Resource
- http://www.osvdb.org/34008 www.osvdb.org
- http://www.securityfocus.com/archive/1/465233/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/466331/100/200/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/23338 www.securityfocus.com
- http://www.securitytracker.com/id?1017897 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA07-100A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/1325 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-021 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1524 oval.cisecurity.org