Veille CVE
CVE-2002-0367
7.8 Élevée Exploitée activementCatalogue CISA KEV — Microsoft Windows Privilege Escalation Vulnerability
Ajoutée le 03/03/2022 · Échéance de correction (agences US) : 24/03/2022
Action requise : Apply updates per vendor instructions.
Description
smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 7.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.2 Élevée | nvd@nist.gov (NVD) | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 Mailing List
- http://www.iss.net/security_center/static/8462.php Broken LinkPatchVendor Advisory
- http://www.securityfocus.com/archive/1/262074 Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory
- http://www.securityfocus.com/archive/1/264441 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/264927 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/4287 Broken LinkThird Party AdvisoryVDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 PatchVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 Broken Link
- http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 Mailing List
- http://www.iss.net/security_center/static/8462.php Broken LinkPatchVendor Advisory
- http://www.securityfocus.com/archive/1/262074 Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory
- http://www.securityfocus.com/archive/1/264441 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/264927 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/4287 Broken LinkThird Party AdvisoryVDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 PatchVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367 US Government Resource