Still Image Service Privilege Escalation Vulnerability

Windows 2000 includes the Still Image service that exposes a vulnerability which could enable a standard user to escalate his or her local privilege level to that of the System.

Issue

An unchecked buffer exists in the 'Still Image Service' on Windows 2000 hosts. A locally logged-on user can execute malicious code that will use the still image service to escalate their permissions equal to that of the Still Image Service, namely, LocalSystem.

The Still Image Service is not installed by default, but is automatically installed, via plug-n-play, when a user attaches a still image device (i.e. digital camera, scanner, etc.) to a Windows 2000 host.

Affected Products

• Microsoft Windows 2000

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24200

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: September 6, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<