PT-2002-1430 · Microsoft · Windows 2000+1

Publicado 2002-06-25 · Atualizado 2025-10-22 · CVE-2002-0367

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows NT and Windows 2000

Description The smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs. This allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Recommendations For Windows NT and Windows 2000, consider restricting access to the smss.exe debugging subsystem to minimize the risk of exploitation. As a temporary workaround, consider disabling the debugging subsystem until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2002-0367

Produtos afetados

Windows 2000

Windows Nt

Referências · 18

• 🔥 https://exploit-db.com/exploits/21344 · Exploit
• 🔥 http://securityfocus.com/archive/1/262074 · Exploit
• http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 · Nota
• https://t.me/cveNotify/139703 · Publicação no Telegram
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367 · Nota
• https://t.me/cvenotify/86397 · Publicação no Telegram
• https://t.me/cveNotify/139780 · Publicação no Telegram
• http://securityfocus.com/bid/4287 · Nota
• https://t.me/cvenotify/110387 · Publicação no Telegram
• http://securityfocus.com/archive/1/264927 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 · Aviso do Fabricante
• https://t.me/cvenotify/114833 · Publicação no Telegram
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0367 · Nota de Segurança