CVE-2002-0367

Опубликовано: 25 июн. 2002

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Ссылки

http://marc.info/?l=ntbugtraq&m=101614320402695&w=2
Mailing List
http://www.iss.net/security_center/static/8462.php
Broken Link
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/262074
Broken Link
Exploit
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
http://www.securityfocus.com/archive/1/264441
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/264927
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/4287
Broken Link
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76
Broken Link
http://marc.info/?l=ntbugtraq&m=101614320402695&w=2
Mailing List
http://www.iss.net/security_center/static/8462.php
Broken Link
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/262074
Broken Link
Exploit
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
http://www.securityfocus.com/archive/1/264441
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/264927
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/4287
Broken Link
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76
Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_2000:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:terminal_server:*:*:*

EPSS

Процентиль: 91%

0.05188

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-269

Связанные уязвимости

GHSA-53gp-9cgv-fj68