CVE-2003-0908 The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that...
HighCVSS 7.2
EPSS 25.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
References
- 20040414 [SHATTER Team Security Alert] Microsoft Windows Utility Manager Vulnerability mailing-list
- www.appsecinc.com patch vendor-advisory
- O-114 government-resource third-party-advisory
- VU#526084 patch third-party-advisory us-government-resource
- www.securiteam.com
- 10124 vdb-entry
- TA04-104A third-party-advisory us-government-resource
- MS04-011 vendor-advisory
- win2k-utilitymgr-gain-privileges(15632) vdb-entry
- oval:org.mitre.oval:def:1046 signature vdb-entry