Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2008-1436
HistoryApr 21, 2008 - 5:05 p.m.

CVE-2008-1436

2008-04-2117:05:00
CWE-264
[email protected]
web.nvd.nist.gov
35
cve-2008-1436
microsoft windows
xp
vista
server 2003
server 2008
privilege escalation
seimpersonateprivilege
token kidnapping
nvd

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

Low

0.944 High

EPSS

Percentile

99.2%

JSON

Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.

Affected configurations

NVD
Node
microsoftwindows-ntMatchvistasp1x64
OR
microsoftwindows-ntMatchvistasp2
OR
microsoftwindows-ntMatchvistasp2x64
OR
microsoftwindows_server_2003
OR
microsoftwindows_server_2003sp1
OR
microsoftwindows_server_2003sp1itanium
OR
microsoftwindows_server_2003sp2
OR
microsoftwindows_server_2008itanium
OR
microsoftwindows_server_2008x32
OR
microsoftwindows_server_2008x64
OR
microsoftwindows_vistax64
OR
microsoftwindows_vistaMatch-sp1
OR
microsoftwindows_xpsp2

References

Related

prion 1
nvd 1
cvelist 1
openvas 2
checkpoint_advisories 1
securityvulns 2
mskb 1
nessus 1
prion
prion
Privilege escalation
2008-04-21 17:05:00
nvd
nvd
CVE-2008-1436
2008-04-21 17:05:00
cvelist
cvelist
CVE-2008-1436
2008-04-21 17:00:00
openvas
openvas
Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
2009-04-15 00:00:00
Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
2009-04-15 00:00:00
checkpoint_advisories
checkpoint_advisories
ASPX Spy (CVE-2008-1436; CVE-2009-0078; CVE-2009-0079; CVE-2009-0080)
2009-07-15 00:00:00
securityvulns
securityvulns
Microsoft Windows privilege escalation
2009-04-14 00:00:00
Microsoft Security Bulletin MS09-012 - Important Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
2009-04-14 00:00:00
mskb
mskb
MS09-012: Vulnerabilities in Windows could allow elevation of privilege
2018-04-17 20:27:02
nessus
nessus
MS09-012: Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
2009-04-15 00:00:00

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

Low

0.944 High

EPSS

Percentile

99.2%

JSON
Related for CVE-2008-1436
prion1nvd1cvelist1openvas2checkpoint_advisories1securityvulns2mskb1nessus1