VulnerabilityModified

CVE-2009-0080

MEDIUM 6.9EPSS 2.36%

Does this matter?

Lower severity and a low EPSS score (2.36%). Track it; it rarely justifies an emergency change on its own.

Description

The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."

CVSS 2.0: 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS: 2.36% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-269
Affected: microsoft/windows server 2008 · microsoft/windows vista
Source: secure@microsoft.com

References

http://osvdb.org/53668Broken Link
http://www.securitytracker.com/id?1022044Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-104A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1026Permissions Required
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6177Third Party Advisory
http://osvdb.org/53668Broken Link
http://www.securitytracker.com/id?1022044Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-104A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1026Permissions Required
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6177Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.