CVE-2002-0367

Published Apr 2, 2003 CVSS 3.1 · 7.8 High EPSS 4.9% KEV · Listed
Description
smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2002-0364 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
History
Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
Type Values Removed Values Added
Weaknesses CWE-269
Metrics kev

{'dateAdded': '2022-03-03'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 22, 2025, 12:05 AM
Reserved
May 8, 2002, 12:00 AM
Status
Analyzed
Published
Jun 25, 2002, 4:00 AM
Modified
Jun 16, 2026, 9:57 PM