Privilege Escalation via Shatter-Style Attack in Microsoft Windows 2000 Utility Manager

CVE-2003-0908 · HIGH Severity

AV:L/AC:L/AU:N/C:C/I:C/A:C

The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.

Learn more about our User Device Pen Test.