CVE-2010-1886

Description

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes, and related to the Windows Service Isolation feature. NOTE: the vendor states that privilege escalation from NetworkService to LocalSystem does not cross a "security boundary."

Related CPE's

omicrosoftwindows_xp-sp3******

omicrosoftwindows_vista*sp2x64*****

omicrosoftwindows_server_2008*sp2itanium*****

omicrosoftwindows_server_2008r2*itanium*****

omicrosoftwindows_server_2008r2*x64*****

omicrosoftwindows_2003_server-sp2x64*****

omicrosoftwindows_vista*sp1x64*****

omicrosoftwindows_7-*******

omicrosoftwindows_server_2008**x32*****

omicrosoftwindows_server_2008**x64*****

References

2264072

PatchVendor Advisory

982316

PatchVendor Advisory

http://www.microsoft.com/technet/security/advisory/2264072.mspx

Vendor Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:L/AC:L/Au:S/C:C/I:C/A:C

AccessVector

LOCAL

AccessComplexity

LOW

Authentication

SINGLE

ConfidentialityImpact

COMPLETE

IntegrityImpact

COMPLETE

AvailabilityImpact

COMPLETE

BaseScore

6.800000190734863

Created by Yello
About Severity.io