CVE-2009-1922

{"id": "CVE-2009-1922", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": true, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-08-12T17:30:00.627", "references": [{"url": "http://en.securitylab.ru/lab/PT-2008-09", "source": "secure@microsoft.com"}, {"url": "http://osvdb.org/56901", "source": "secure@microsoft.com"}, {"url": "http://secunia.com/advisories/36214", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/archive/1/505691/100/0/threaded", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id?1022714", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-040", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6109", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka \"MSMQ Null Pointer Vulnerability.\""}, {"lang": "es", "value": "El servicio de cola de mensajes de Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, y Vista Gold no valida de forma adecuada los datos de una petici\u00f3n inespec\u00edfica IOCTL en el modo de usuario antes de pasar esta petici\u00f3n al modo kernel, lo que permite a usuarios locales conseguir un aumento de privilegios a trav\u00e9s de una petici\u00f3n manipulada, tambi\u00e9n conocido como \"Vulnerabilidad de puntero nulo MSMQ\""}], "lastModified": "2019-02-26T14:04:00.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA2CBE65-F4B6-49AF-983C-D3CF6C172CC5"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3852BB02-47A1-40B3-8E32-8D8891A53114"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:-:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD560746-0AED-4646-934E-6742888FB6F2"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34DF3B5E-F17F-49B4-9DC8-06749F3C9CC3"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFAC3F90-77BF-4F56-A89B-8A3D2D1FC6D6"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}