CVE-2008-1436

EXPLOITED

Microsoft Windows XP-Vista-2003-2008 - Privilege Escalation

Title source: llm

Description

Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Cesar Cerrudo · textlocalwindows

https://www.exploit-db.com/exploits/6705

View Code ZIP pw:eip

exploitdb SUSPICIOUS VERIFIED

by Cesar Cerrudo · textlocalwindows

https://www.exploit-db.com/exploits/31667

View Code ZIP pw:eip

References (20)

[Various Sources] http://blogs.technet.com/msrc/archive/2008/04/17/msrc-blog-microsoft-security-advisory-951306.aspx

[Various Sources] http://isc.sans.org/diary.html?storyid=4306

[Various Sources] http://milw0rm.com/sploits/2008-Churrasco.zip

[Various Sources] http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html

[Vendor Advisory] http://secunia.com/advisories/29867

[Various Sources] http://securitywatch.eweek.com/flaws/microsoft_belatedly_admits_to_windows_server_2008_token_kidnapping.html

[Various Sources] http://www.argeniss.com/research/Churrasco.zip

[Various Sources] http://www.argeniss.com/research/TokenKidnapping.pdf

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA09-104A.html

[Vendor Advisory] http://www.vupen.com/english/advisories/2008/1264/references

[Vendor Advisory] http://www.vupen.com/english/advisories/2009/1026

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41880

[Vendor Advisory] http://www.microsoft.com/technet/security/advisory/951306.mspx

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/491111/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/497168/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/28833

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/6705

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5891

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019904

Scores

EPSS 0.5788

EPSS Percentile 98.2%

Details

VulnCheck KEV 2009-04-14

CWE

CWE-264

Status published

Products (5)

microsoft/windows-nt vista sp1 (3 CPE variants)

microsoft/windows_server_2003 (4 CPE variants)

microsoft/windows_server_2008 (3 CPE variants)

microsoft/windows_vista (2 CPE variants)

microsoft/windows_xp

Published Apr 21, 2008

Tracked Since Feb 18, 2026