Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2002-0367

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Published

2002-06-25T04:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-noinfo
Type: Secondary
CWE-269

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	microsoft	windows_2000	-	Yes
Operating System	microsoft	windows_nt	4.0	Yes
Operating System	microsoft	windows_nt	4.0	Yes

References

http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 Mailing List ([email protected])
http://www.iss.net/security_center/static/8462.php Broken Link, Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/262074 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/264441 Broken Link, Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/archive/1/264927 Broken Link, Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/4287 Broken Link, Third Party Advisory, VDB Entry ([email protected])
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 Patch, Vendor Advisory ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 Broken Link ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 Broken Link ([email protected])
http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://www.iss.net/security_center/static/8462.php Broken Link, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/262074 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/264441 Broken Link, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/264927 Broken Link, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/4287 Broken Link, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 Broken Link (af854a3a-2127-422b-91ae-364da2661108)