eEye Digital Security has discovered a local privilege escalation vulnerability in Windows Vista that allows a program executing without privileges to fully compromise an affected system. A malicious user or malware program could exploit this vulnerability to execute arbitrary code with SYSTEM privileges within the CSRSS process, permitting the bypass of Vista’s vaunted user privilege limitations and administrator approval mode. By establishing and closing multiple connections to CSRSS’s “ApiPort”, an application may cause a private data structure within CSRSS that describes its process to be used after it has been freed, creating an exploitable “dangling pointer” condition. This vulnerability is entirely separate from the CSRSS NtRaiseHardError message box flaw publicly disclosed in December 2006, although both affect code within the CSRSS process. It is interesting to note that this vulnerability only affects Windows Vista, due to new, flawed code added to CSRSRV.DLL in support of functionality introduced in Vista.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/55832/EEYE-csrss.txt
Source: https://packetstormsecurity.com/files/55832/EEYE-csrss.txt.html