CVE-2013-5065

What is NDProxy.sys?

NDProxy.sys is a Windows kernel driver that provides NDIS (Network Driver Interface Specification) proxy functionality for WAN (Wide Area Network) miniport drivers — specifically used with dial-up networking and some VPN implementations. It was present in Windows XP and Windows Server 2003 but was substantially changed in Windows Vista. The driver handles DeviceIoControl calls from user-mode applications related to network connection management, and improper input validation in these IOCTL handlers provided the escalation path.

Overview

CVE-2013-5065 is an improper input validation vulnerability in NDProxy.sys in the Windows kernel that allows a local user to escalate privileges to SYSTEM. A crafted DeviceIoControl call to the NDProxy driver triggers a kernel-mode memory access violation that can be leveraged for code execution at ring 0. This vulnerability was exploited as a zero-day chained with CVE-2013-3346 (Adobe Reader ToolButton use-after-free) to achieve full system compromise from a malicious PDF — the Reader vulnerability provides initial code execution in the Reader sandbox, and CVE-2013-5065 escapes the sandbox and escalates to SYSTEM.

Microsoft acknowledged the zero-day on November 27, 2013, and patched it in MS13-101 on December 10, 2013.

Affected Versions

The vulnerability is XP and Server 2003 specific — the NDProxy driver in Vista and later was significantly changed and does not contain this vulnerability. This specificity was significant: in late 2013, Windows XP still accounted for a very large fraction of enterprise Windows deployments (approaching end-of-life in April 2014).

Technical Details

NDProxy.sys exposes a device interface that user-mode applications can access via DeviceIoControl. The driver's IOCTL handler did not properly validate input parameters, allowing a local process to send a crafted IOCTL that causes the kernel driver to access memory inappropriately — producing a controllable fault in ring 0.

The two-stage attack chain (as reported by FireEye):

1. Stage 1 — CVE-2013-3346: A malicious PDF opens in Adobe Reader. The ToolButton use-after-free achieves code execution inside Reader's Protected Mode sandbox — the attacker can run code, but it is constrained by the Reader sandbox.
2. Stage 2 — CVE-2013-5065: From within the Reader sandbox, the attacker's code makes a crafted DeviceIoControl call to NDProxy.sys. Because NDProxy is a kernel driver accessible from sandboxed processes, the improper input validation allows kernel code execution, escalating to SYSTEM privilege and escaping the sandbox entirely.
3. The fully escaped, SYSTEM-privileged code installs a RAT (PlugX and other custom backdoors were delivered in these campaigns) for persistent access.

Why XP-only mattered: While limiting the vulnerability to XP/2003 reduced its scope compared to a cross-version vulnerability, Windows XP's enormous installed base in 2013 — particularly in Asia-Pacific enterprise environments where the targeted organizations operated — made this highly effective.

Discovery

Identified by FireEye researchers analyzing in-the-wild targeted attacks against specific organizations in November 2013. Microsoft acknowledged the zero-day exploitation in Security Advisory 2914486 on November 27, 2013 — within days of the FireEye report.

Exploitation Context

CISA confirmed exploitation in the wild. The CVE-2013-3346 + CVE-2013-5065 chain was used in precision APT campaigns delivering PlugX and related RATs against targeted organizations. FireEye attributed the attacks to a Chinese state-sponsored actor. The sophistication of the two-stage chain — simultaneously maintaining a Reader sandbox escape and a Windows XP kernel LPE zero-day — indicates a well-resourced, deliberate targeting operation.

Remediation

1. Apply MS13-101 (December 2013) — patches NDProxy.sys on affected Windows XP and Server 2003 systems
2. Windows XP reached end-of-life on April 8, 2014 — any remaining XP systems should be treated as fully unpatched for all vulnerabilities discovered after that date
3. Upgrade all Windows XP systems to Windows 10 or later — no further security patches are available for XP
4. Apply Adobe Reader patches for CVE-2013-3346 (APSB13-22) to remove the initial code execution component of this chain
5. Enforce network segmentation to limit access from any potentially compromised workstations running XP