Signature Detail

HTTP: Adobe Acrobat Reader CVE-2013-5065 Malicious Dropper

This signature detects the pdf dropper that is being used in-the-wild to exploit a known privilege escalation vulnerability against Windows XP and Windows Server 2003. Successful exploitation could lead to arbitrary code execution in Kernel mode.

Extended Description

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

Affected Products

• microsoft windows_2003_server (sp2)
• microsoft windows_xp (sp2)
• microsoft windows_xp (sp3)

References

• CVE: CVE-2013-5065
• URL: http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html