CVE-2009-1922

2009-08-1217:30:00

CWE-264

microsoft

web.nvd.nist.gov

msmq

microsoft windows

local privilege escalation

crafted requests

cve-2009-1922

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.3

Confidence

Low

EPSS

Percentile

0.4%

JSON

The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka “MSMQ Null Pointer Vulnerability.”

Affected configurations

Nvd

Node

microsoftwindows_2000Match-sp4

microsoftwindows_server_2003sp2

microsoftwindows_vista

microsoftwindows_vistaMatch--x64

microsoftwindows_xpMatch-sp2

microsoftwindows_xpMatch-sp2x64

VendorProductVersionCPE
microsoftwindows_2000-cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
microsoftwindows_server_2003*cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
microsoftwindows_vista-cpe:2.3:o:microsoft:windows_vista:-:-:x64:*:*:*:*:*
microsoftwindows_xp-cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
microsoftwindows_xp-cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_2000	-	cpe:2.3:o:microsoft:windows_2000:-:sp4::::::
microsoft	windows_server_2003	*	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
microsoft	windows_vista	*	cpe:2.3:o:microsoft:windows_vista::::::::
microsoft	windows_vista	-	cpe:2.3:o:microsoft:windows_vista:-:-:x64:::::*
microsoft	windows_xp	-	cpe:2.3:o:microsoft:windows_xp:-:sp2::::::
microsoft	windows_xp	-	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*