CVE-2008-1436
HIGH 9.0EPSS 36.8%
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
- CVSS v2.0
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 36.83% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2008-04-21
- Updated
- 2024-08-07
Proof-of-concept exploits (3)
- http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html
- https://www.exploit-db.com/exploits/6705
- http://www.securityfocus.com/archive/1/497168/100/0/threaded