CVE-2002-0367: microsoft windows 2000 +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2002-0367

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 4,9%

Kerentanan Improper Privilege Management pada microsoft windows 2000, microsoft windows nt. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

Rincian

Terbit di NVD: 25 Juni 2002
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-269: Improper Privilege Management
EPSS (30 hari): 4,9% peluang dieksploitasi; lebih tinggi dari 91,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Windows Privilege Escalation Vulnerability
Masuk KEV: 3 Maret 2022
Tenggat CISA: 24 Maret 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	windows 2000	Semua versi
microsoft	windows nt	Versi 4.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.iss.net/security_center/static/8462.php broken link · patch · advisory vendor
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024 patch · advisory vendor
http://www.securityfocus.com/archive/1/262074 broken link · exploit · patch · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367 pemerintah AS
http://www.securityfocus.com/archive/1/264441 broken link · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/archive/1/264927 broken link · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/4287 broken link · advisory pihak ketiga · vdb entry
http://marc.info/?l=ntbugtraq&m=101614320402695&w=2 mailing list
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158 broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.