PT-2003-1554 · Microsoft · Windows 2000

Chris Paget · Published 2003-07-10 · Updated 2019-04-30 · CVE-2003-0350

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Windows 2000

Description: The issue concerns the Accessibility Utility Manager on Windows, where the control for listing accessibility options does not properly handle Windows messages. This allows local users to execute arbitrary code via a specific style message to the Utility Manager that references a user-controlled callback function, known as a "Shatter" style message.

Recommendations: For Windows 2000, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0350

Affected Products

Windows 2000

References · 8

• http://ngssoftware.com/advisories/utilitymanager.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0350 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-025 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0015.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=105777681615939&w=2 · Note
• http://securityfocus.com/bid/8154 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12543 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A451 · Note