CVE-2003-0350

Windows 2000 - Local Privilege Escalation via Accessibility Utility Manager Shatter Attack

Title source: llm

Description

The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages, which allows local users to execute arbitrary code via a "Shatter" style message to the Utility Manager that references a user-controlled callback function.

References (7)

Core 7

Core References

Patch, Vendor Advisory x_refsource_misc

http://www.ngssoftware.com/advisories/utilitymanager.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/12543

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A451

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-025

Patch, Vendor Advisory mailing-list x_refsource_vulnwatch

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0015.html

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=105777681615939&w=2

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/8154

Scores

EPSS 0.0161

EPSS Percentile 73.6%

Details

Status published

Products (1)

microsoft/windows_2000 (4 CPE variants)

Published Aug 18, 2003

Tracked Since Feb 18, 2026