Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes, and related to the Windows Service Isolation feature. NOTE: the vendor states that privilege escalation from NetworkService to LocalSystem does not cross a "security boundary."
References
| Link | Resource |
|---|---|
| http://support.microsoft.com/kb/2264072 | Patch Vendor Advisory |
| http://support.microsoft.com/kb/982316 | Patch Vendor Advisory |
| http://www.microsoft.com/technet/security/advisory/2264072.mspx | Vendor Advisory |
| http://support.microsoft.com/kb/2264072 | Patch Vendor Advisory |
| http://support.microsoft.com/kb/982316 | Patch Vendor Advisory |
| http://www.microsoft.com/technet/security/advisory/2264072.mspx | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://support.microsoft.com/kb/2264072 - Patch, Vendor Advisory | |
| References | () http://support.microsoft.com/kb/982316 - Patch, Vendor Advisory | |
| References | () http://www.microsoft.com/technet/security/advisory/2264072.mspx - Vendor Advisory |
07 Dec 2023, 18:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:* |
Information
Published : 2010-08-16 18:39
Updated : 2024-11-21 01:15
NVD link : CVE-2010-1886
Mitre link : CVE-2010-1886
CVE.ORG link : CVE-2010-1886
JSON object : View
Products Affected
microsoft
- windows_server_2008
- windows_vista
- windows_2003_server
- windows_xp
- windows_7
CWE
CWE-264
Permissions, Privileges, and Access Controls