PT-2004-2531 · Microsoft+2 · Notepad+++3

Kf · Publicado 2004-10-21 · Atualizado 2017-07-11 · CVE-2004-1624

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Carbon Copy version 6.0.5257

Description The issue allows local users to gain privileges via the help topic interface in CCW32.exe, which launches Notepad, or the help button in the Carbon Copy Scheduler (CCSched.exe), because system privileges are not dropped when opening external programs.

Recommendations For Carbon Copy version 6.0.5257, consider restricting access to the help topic interface in CCW32.exe and the help button in CCSched.exe to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-1624

Produtos afetados

Ccsched.Exe

Ccw32.Exe

Carbon Copy

Notepad++

Referências · 5

• http://marc.info/?l=bugtraq&m=109846296406459&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17838 · Nota
• http://secunia.com/advisories/12962 · Aviso do Fabricante
• http://securityfocus.com/bid/11500 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1624 · Nota de Segurança