CVE-2002-0367highunder attackCWE-269

CVE-2002-0367

Published · Updated

Follow this CVE+ Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 4.9%
from disclosure to weaponsame day
Published on NVDApr 2
1st PoCMar 13
CISA KEV+6910d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A flaw in Windows NT and Windows 2000's debugging system fails to properly verify which programs can connect to each other, allowing a local user to steal control of a privileged process and gain administrator or SYSTEM-level access.

Technical detail

The Session Manager subsystem (smss.exe) in Windows NT/2000 lacks proper authentication for inter-process connections, enabling local attackers to duplicate handles to privileged processes and escalate privileges to SYSTEM or administrator level. Attack requires local system access and exploits insufficient authorization checks in the debug subsystem's handle duplication mechanism.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.