BID:8154

Microsoft Windows Accessibility Utility Manager Privilege Escalation Vulnerability

Info

Microsoft Windows Accessibility Utility Manager Privilege Escalation Vulnerability

Bugtraq ID:	8154
Class:	Input Validation Error
CVE:	CVE-2003-0350
Remote:	No
Local:	Yes
Published:	Jul 09 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery credited to Chris Paget.
Vulnerable:	Microsoft Windows 2000 Terminal Services SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Terminal Services + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Server Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:	Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4

Exploit / POC

Microsoft Windows Accessibility Utility Manager Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Microsoft Windows Accessibility Utility Manager Privilege Escalation Vulnerability

Solution:
Microsoft has made fixes available. These fixes are included in Microsoft Windows 2000 SP4, so users should upgrade to that version if possible. Users of Datacenter platforms will likely need to contact their vendor to obtain updates.

The following fixes are available:

Microsoft Windows 2000 Professional