{"id":"CVE-2008-1436","url":"https://www.cyber-defence.io/tools/cve/CVE-2008-1436","generatedAt":"2026-10-27T18:39:50.985Z","title":"Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service…","description":"Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.","published":"2008-04-21T17:05:00.000Z","lastModified":"2026-06-16T22:51:44.000Z","status":"Modified","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"2.0","score":9,"severity":"HIGH","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C"},"cwe":["CWE-264"],"affected":["microsoft/windows-nt","microsoft/windows server 2003","microsoft/windows server 2008","microsoft/windows vista","microsoft/windows xp"],"epss":{"score":0.36829,"percentile":0.98497,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2008-04-17","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":31667,"kind":"exploit","title":"Microsoft Windows - 'SeImpersonatePrivilege' Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/31667","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/31667.txt","file":"exploits/windows/local/31667.txt","published":"2008-04-17","added":"2008-04-17","updated":"2014-02-17","author":"Cesar Cerrudo","type":"local","platform":"windows","port":null,"verified":true,"codes":["CVE-2008-1436","OSVDB-44580"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/28833/info"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 36.8%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://blogs.technet.com/msrc/archive/2008/04/17/msrc-blog-microsoft-security-advisory-951306.aspx","source":"secure@microsoft.com"},{"url":"http://isc.sans.org/diary.html?storyid=4306","source":"secure@microsoft.com"},{"url":"http://milw0rm.com/sploits/2008-Churrasco.zip","source":"secure@microsoft.com"},{"url":"http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html","source":"secure@microsoft.com"},{"url":"http://secunia.com/advisories/29867","tags":["Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"http://securitywatch.eweek.com/flaws/microsoft_belatedly_admits_to_windows_server_2008_token_kidnapping.html","source":"secure@microsoft.com"},{"url":"http://www.argeniss.com/research/Churrasco.zip","source":"secure@microsoft.com"},{"url":"http://www.argeniss.com/research/TokenKidnapping.pdf","source":"secure@microsoft.com"},{"url":"http://www.microsoft.com/technet/security/advisory/951306.mspx","source":"secure@microsoft.com"},{"url":"http://www.securityfocus.com/archive/1/491111/100/0/threaded","source":"secure@microsoft.com"},{"url":"http://www.securityfocus.com/archive/1/497168/100/0/threaded","source":"secure@microsoft.com"},{"url":"http://www.securityfocus.com/bid/28833","source":"secure@microsoft.com"},{"url":"http://www.securitytracker.com/id?1019904","source":"secure@microsoft.com"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-104A.html","tags":["US Government Resource"],"source":"secure@microsoft.com"},{"url":"http://www.vupen.com/english/advisories/2008/1264/references","tags":["Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"http://www.vupen.com/english/advisories/2009/1026","tags":["Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012","source":"secure@microsoft.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41880","source":"secure@microsoft.com"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5891","source":"secure@microsoft.com"},{"url":"https://www.exploit-db.com/exploits/6705","source":"secure@microsoft.com"},{"url":"http://blogs.technet.com/msrc/archive/2008/04/17/msrc-blog-microsoft-security-advisory-951306.aspx","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://isc.sans.org/diary.html?storyid=4306","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://milw0rm.com/sploits/2008-Churrasco.zip","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/29867","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitywatch.eweek.com/flaws/microsoft_belatedly_admits_to_windows_server_2008_token_kidnapping.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.argeniss.com/research/Churrasco.zip","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.argeniss.com/research/TokenKidnapping.pdf","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.microsoft.com/technet/security/advisory/951306.mspx","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/491111/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/497168/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/28833","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id?1019904","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-104A.html","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2008/1264/references","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2009/1026","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41880","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5891","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/6705","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-1436","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}