vulnwire
7.8high

CVE-2002-0367KEVin critical feed1 exploit

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which a…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-03
EPSS
4.9%
percentile 92%
Public exploits
1
Exploit-DB

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-03-24 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Microsoft / Windows
CISA name
Microsoft Windows Privilege Escalation Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

4.92% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-21344 Microsoft Windows NT 4.0/2000 - Process Handle Local Privilege Escalation · local · 2002-03-13

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

  • securityfocus.com /archive/1/264441 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • marc.info /?l=ntbugtraq&m=101614320402695&w=2 · mailing-list, x_refsource_NTBUGTRAQ, x_transferred
  • securityfocus.com /bid/4287 · vdb-entry, x_refsource_BID, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2002/ms02-024 · vendor-advisory, x_refsource_MS, x_transferred
  • securityfocus.com /archive/1/264927 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityfocus.com /archive/1/262074 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • iss.net /security_center/static/8462.php · vdb-entry, x_refsource_XF, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.