New Search

Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation

oval:org.mitre.oval:def:681

NetDDE Agent on Windows NT 4.0 4.0 Terminal Server Edition Windows 2000 and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message as demonstrated by GetAd aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation."

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows NT
Class:
vulnerability
Reference(s):
  • CVE-2002-1230
Product(s):
  • NetDDE Agent