CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 4.6
CWE Name:  Permissions Privileges and Access Controls
Summary: ** disputed **  the ntuserconsolecontrol function in win32k.sys in microsoft windows xp sp2 and sp3, and server 2003 before sp1, allows local administrators to bypass unspecified "security software" and gain privileges via a crafted call that triggers an overwrite of an arbitrary memory location.  note: the vendor disputes the significance of this report, stating that 'the administrator to system "escalation" is not a security boundary we defend.'
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2009-08-03
Last Modified Date: 2017-09-19