Microsoft Windows 2000 Utility Manager Privilege Escalation
Vulnerability
http://secunia.com/advisories/12051/


Secunia Advisory: SA12051
Release Date: 2004-07-13

Critical: Less critical
Impact: Privilege escalation
Where: Local system

OS: Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server

Choose a product and view comprehensive vulnerability statistics and
all Secunia advisories affecting it.

CVE reference: CAN-2004-0213

Description:
Cesar Cerrudo has discovered a vulnerability in Microsoft Windows
2000, which can be exploited by malicious, local users to gain
escalated privileges.

The vulnerability is caused due to an insecurity in the way the
Utility Manager utility launches applications and can be exploited by
sending a specially crafted message to the Utility Manager process.

Successful exploitation allows executing an arbitrary application with
SYSTEM privileges.

Solution:
Apply patch.

Microsoft Windows 2000 (requires SP2, SP3, or SP4):
http://www.microsoft.com/downloa...-...displaylang=en

Provided and/or discovered by:
Cesar Cerrudo

Original Advisory:
MS04-019 (KB842526):
http://www.microsoft.com/technet/sec.../MS04-019.mspx


--
Meritorios de Filtrado (Kill-File Global):
tella llop, jm (N.B. 2003.10.25)


«Prefiero molestar con la verdad que complacer con adulaciones (Lucio Anneo Seneca)»