Vulnerability Details : CVE-2013-5065
Public exploit exists!
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
Vulnerability category: Input validation
CVE-2013-5065 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Windows Kernel Privilege Escalation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2013-5065
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 22 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2013-5065
-
MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation
Disclosure Date: 2013-11-27First seen: 2020-04-26exploit/windows/local/ms_ndproxyThis module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003 SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used
CVSS scores for CVE-2013-5065
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
CWE ids for CVE-2013-5065
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-5065
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002
Microsoft Security Bulletin MS14-002 - Important | Microsoft Docs
-
http://technet.microsoft.com/security/advisory/2914486
Microsoft Security Advisory 2914486 | Microsoft DocsPatch;Vendor Advisory
-
https://www.exploit-db.com/exploits/37732/
Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002) - Windows_x86 local Exploit
-
http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html
MS Windows Local Privilege Escalation Zero-Day in The Wild | FireEye IncNot Applicable
Products affected by CVE-2013-5065
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*