CVE-2010-1886

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes, and related to the Windows Service Isolation feature. NOTE: the vendor states that privilege escalation from NetworkService to LocalSystem does not cross a "security boundary."

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 3.1 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://support.microsoft.com/kb/2264072	Patch Vendor Advisory
http://support.microsoft.com/kb/982316	Patch Vendor Advisory
http://www.microsoft.com/technet/security/advisory/2264072.mspx	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
	cpe:2.3:o:microsoft:windows_2003_server:-:sp2:x64:::::*
	cpe:2.3:o:microsoft:windows_7:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
	cpe:2.3:o:microsoft:windows_server_2008::sp2:itanium:::::
	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::
	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2:professional:::::
	cpe:2.3:o:microsoft:windows_xp:-:sp3::::::

History

07 Dec 2023, 18:38

Type	Values Removed	Values Added
CPE	cpe:2.3:o:microsoft:windows_vista::sp1:x64::::: cpe:2.3:o:microsoft:windows_vista::sp2:x64:::::

Information

Published : 2010-08-16 18:39

Updated : 2024-02-04 17:54

NVD link : CVE-2010-1886

Mitre link : CVE-2010-1886

CVE.ORG link : CVE-2010-1886

JSON object : View

Products Affected

microsoft

windows_2003_server
windows_7
windows_xp
windows_server_2008
windows_vista

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-1886", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-08-16T18:39:40.560", "references": [{"url": "http://support.microsoft.com/kb/2264072", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://support.microsoft.com/kb/982316", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.microsoft.com/technet/security/advisory/2264072.mspx", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes, and related to the Windows Service Isolation feature. NOTE: the vendor states that privilege escalation from NetworkService to LocalSystem does not cross a \"security boundary.\""}, {"lang": "es", "value": "Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 SP2 y R2, y Windows 7 permiten a usuarios locales escalar privilegios accediendo a procesos con credenciales NetworkService, como sucede con los procesos servidor TAPI, SQL Server, e IIS. Relacionado con la funcionalidad \"Windows Service Isolation\". NOTA: el vendedor afirma que el escalado de privilegios de NetworkService a LocalSystem no traspasa un \"security boundary\" (frontera de seguridad)."}], "lastModified": "2023-12-07T18:38:56.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2978BF86-5A1A-438E-B81F-F360D0E30C9C"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7EFB032-47F4-4497-B16B-CB9126EAC9DF"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:-:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D5F7729-A095-43DF-BF2F-B4B6938087FA"}, {"criteria": "cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E33796DB-4523-4F04-B564-ADF030553D51"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CFB1A97-8042-4497-A45D-C014B5E240AB"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F9C7616-658D-409D-8B53-AC00DC55602A"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C684420-1614-4DAE-9BD9-F1FE9102A50F"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC916D5A-0644-4423-A52E-D4310906BE78"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95DC297F-06DB-4FB3-BFB6-7312C059E047"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C162FFF0-1E8F-4DCF-A08F-6C6E324ED878"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0D2704-C058-420B-B368-372D1129E914"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:professional:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C29F02ED-85FC-4D22-A6DE-5F9C77ECCD70"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9392D35-7BF5-48E9-879B-BBDE9A9E9AB9"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}