Microsoft Windows XP Task Scheduler eventtriggers.exe privileges management
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
7.5 | $0-$5k | 0.00 |
A vulnerability was found in Microsoft Windows XP (Operating System) and classified as critical. This issue affects an unknown function of the file eventtriggers.exe of the component Task Scheduler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability."
The weakness was published 06/01/2004 as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. The identification of this vulnerability is CVE-2003-0909. The exploitation is known to be easy. Attacking locally is a requirement. The successful exploitation requires a simple authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.
The vulnerability scanner Nessus provides a plugin with the ID 12205 (MS04-011: Microsoft Hotfix (credentialed check) (835732)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows : Microsoft Bulletins. The commercial vulnerability scanner Qualys is able to test this issue with plugin 90108 (Multiple Microsoft Windows Vulnerabilities (MS04-011)).
Upgrading eliminates this vulnerability.
The vulnerability is also documented in the databases at X-Force (15818) and Tenable (12205). Similar entries are available at 530, 599, 600 and 603.
Product
Type
Vendor
Name
Version
License
Support
- end of life (old version)
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.8VulDB Meta Temp Score: 7.5
VulDB Base Score: 7.8
VulDB Temp Score: 7.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Privileges managementCWE: CWE-269 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 12205
Nessus Name: MS04-011: Microsoft Hotfix (credentialed check) (835732)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 101011
OpenVAS Name: MS04-011 security check
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Timeline
11/04/2003 🔍04/13/2004 🔍
04/13/2004 🔍
04/14/2004 🔍
06/01/2004 🔍
06/01/2004 🔍
10/16/2014 🔍
06/29/2021 🔍
Sources
Vendor: microsoft.comProduct: microsoft.com
Advisory: kb.cert.org
Status: Confirmed
CVE: CVE-2003-0909 (🔍)
OVAL: 🔍
X-Force: 15818
Vulnerability Center: 4121 - [MS04-011] Windows XP Allows Privilege Elevation, Medium
SecurityFocus: 10125
See also: 🔍
Entry
Created: 10/16/2014 17:28Updated: 06/29/2021 17:53
Changes: 10/16/2014 17:28 (42), 04/07/2017 16:03 (27), 06/29/2021 17:38 (2), 06/29/2021 17:45 (2), 06/29/2021 17:53 (1)
Complete: 🔍
Cache ID: 18:D26:103
No comments yet. Languages: en.
Please log in to comment.