CVE-2010-1886

Опубликовано: 16 авг. 2010

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes, and related to the Windows Service Isolation feature. NOTE: the vendor states that privilege escalation from NetworkService to LocalSystem does not cross a "security boundary."

Ссылки

http://support.microsoft.com/kb/2264072
Patch
Vendor Advisory
http://support.microsoft.com/kb/982316
Patch
Vendor Advisory
http://www.microsoft.com/technet/security/advisory/2264072.mspx
Vendor Advisory
http://support.microsoft.com/kb/2264072
Patch
Vendor Advisory
http://support.microsoft.com/kb/982316
Patch
Vendor Advisory
http://www.microsoft.com/technet/security/advisory/2264072.mspx
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2003_server:-:sp2:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp2:professional:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00735

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-8373-fv3p-rhqq

github

больше 3 лет назад