CVE-2008-1436

Published Apr 21, 2008

Last updated 6 years ago

Overview

Description: Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
Source: secure@microsoft.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 9
Impact score: 10
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: CWE-264

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows-nt:vista:sp1:x64:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C52FFD3E-195E-4A61-9789-AF5A3EFB3A62"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows-nt:vista:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9E15E896-99D9-4558-B85E-069D2F2EA565"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows-nt:vista:sp2:x64:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0BA8CAFA-7C40-4692-A7C4-403315BF3E6E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "31A64C69-D182-4BEC-BA8A-7B405F5B2FC0"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA778424-6F70-4AB6-ADD5-5D4664DFE463"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCE2197B-7C58-4693-B9BB-0B31EABB6B66"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F6EA111-A4E6-4963-A0C8-F9336C605B6E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9CFB1A97-8042-4497-A45D-C014B5E240AB"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F9C7616-658D-409D-8B53-AC00DC55602A"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1DD1D5ED-FE7C-4ADF-B3AF-1F13E51B4FB5"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A04E39A-623E-45CA-A5FC-25DAA0F275A3"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References