Vulnerability CVE-2004-1624

Vulnerability CVE-2004-1624

Published: 2004-10-21 Modified: 2012-02-12

Description:

Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.2/10	10/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Altiris -> Carbon copy

References:

http://xforce.iss.net/xforce/xfdb/17838

http://www.securityfocus.com/bid/11500

http://secunia.com/advisories/12962

http://marc.theaimsgroup.com/?l=bugtraq&m=109846296406459&w=2

Copyright 2024, cxsecurity.com