Vulnerability in Microsoft Windows-Nt
CVE-2008-1436
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
EPSS: 0.368 (98.3th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Windows-nt — versions vista
- Microsoft Windows_server_2003
- Microsoft Windows_server_2008
- Microsoft Windows_vista
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (mailing-list, x_refsource_BUGTRAQ)
- secure@microsoft.com (x_refsource_CONFIRM)
- secure@microsoft.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- secure@microsoft.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secure@microsoft.com (x_refsource_MISC)
- secure@microsoft.com (exploit, x_refsource_EXPLOIT-DB)
- secure@microsoft.com (x_refsource_MISC)
- secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)