CVE-2006-4465

Microsoft Terminal Server - Local Arbitrary Code Execution via Explorer Error

Title source: llm
STIX 2.1

Description

Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile and Client Connection Manager wizard" options, allows local users to execute arbitrary code by forcing an Explorer error. NOTE: a third-party researcher has stated that the options are "a convenience to users" and were not intended to restrict execution of arbitrary code

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/443428/100/200/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/443364/100/200/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1486

Scores

EPSS 0.0943
EPSS Percentile 94.9%

Details

Status published
Products (1)
microsoft/terminal_server
Published Aug 31, 2006
Tracked Since Feb 18, 2026