CVE-2009-1922: Medium severity Microsoft Windows 2000 vulnerability

Published Aug 12, 2009

Updated

The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka "MSMQ Null Pointer Vulnerability."

Affected Software

6 affected components

Microsoft Windows 2000=sp4

Microsoft Windows Server 2003=sp2

Microsoft Windows Vista

Microsoft Windows XP=sp2

Event History

Aug 12, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1922?

CVE-2009-1922 is considered a moderate-severity vulnerability allowing local privilege escalation.

How do I fix CVE-2009-1922?

To mitigate CVE-2009-1922, apply the latest security updates and patches provided by Microsoft for affected operating systems.

Which operating systems are affected by CVE-2009-1922?

CVE-2009-1922 affects Microsoft Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP2, and Windows Vista.

Can CVE-2009-1922 be exploited remotely?

No, CVE-2009-1922 can only be exploited by local users who have access to the affected system.

What type of vulnerability is CVE-2009-1922?

CVE-2009-1922 is a local privilege escalation vulnerability in the Message Queuing service.