Vulnerability Details : CVE-2013-5065
Public exploit exists!
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
Products affected by CVE-2013-5065
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*
CVE-2013-5065 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Windows Kernel Privilege Escalation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2013-5065
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2013-5065
43.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2013-5065
-
MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation
Disclosure Date: 2013-11-27First seen: 2020-04-26exploit/windows/local/ms_ndproxyThis module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003 SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used
CVSS scores for CVE-2013-5065
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-07-24 |
References for CVE-2013-5065
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002
Microsoft Security Bulletin MS14-002 - Important | Microsoft DocsPatch;Vendor Advisory
-
http://technet.microsoft.com/security/advisory/2914486
Microsoft Security Advisory 2914486 | Microsoft DocsPatch;Vendor Advisory
-
https://www.exploit-db.com/exploits/37732/
Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002) - Windows_x86 local ExploitExploit;Third Party Advisory;VDB Entry
-
http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html
MS Windows Local Privilege Escalation Zero-Day in The Wild | FireEye IncBroken Link;Not Applicable
Jump to