CVE-2002-0367 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges....
HighCVSS 7.8
EPSS 4.9%
CISA KEV
added 2022-03-03 · due 2022-03-24
Exploited in the wild
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
References
- 20020314 DebPloit (exploit) mailing-list
- win-debug-duplicate-handles(8462) broken-link patch vdb-entry vendor-advisory
- 20020314 Fwd: DebPloit (exploit) broken-link exploit mailing-list patch third-party-advisory vdb-entry
- 20020326 Re: DebPloit (exploit) broken-link mailing-list third-party-advisory vdb-entry
- 20020327 Local Security Vulnerability in Windows NT and Windows 2000 broken-link mailing-list third-party-advisory vdb-entry
- 4287 broken-link third-party-advisory vdb-entry
- MS02-024 patch vendor-advisory
- oval:org.mitre.oval:def:158 broken-link signature vdb-entry
- oval:org.mitre.oval:def:76 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource