CVE-2009-1922
First published: Wed Aug 12 2009(Updated: )
The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka "MSMQ Null Pointer Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows Vista | ||
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows 2000 | =sp4 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Vista |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/56901
- http://www.securitytracker.com/id?1022714
- http://secunia.com/advisories/36214
- http://en.securitylab.ru/lab/PT-2008-09
- http://www.us-cert.gov/cas/techalerts/TA09-223A.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6109
- http://www.securityfocus.com/archive/1/505691/100/0/threaded
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-040
Frequently Asked Questions
What is the severity of CVE-2009-1922?
CVE-2009-1922 is considered a moderate-severity vulnerability allowing local privilege escalation.
How do I fix CVE-2009-1922?
To mitigate CVE-2009-1922, apply the latest security updates and patches provided by Microsoft for affected operating systems.
Which operating systems are affected by CVE-2009-1922?
CVE-2009-1922 affects Microsoft Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP2, and Windows Vista.
Can CVE-2009-1922 be exploited remotely?
No, CVE-2009-1922 can only be exploited by local users who have access to the affected system.
What type of vulnerability is CVE-2009-1922?
CVE-2009-1922 is a local privilege escalation vulnerability in the Message Queuing service.
- agent/first-publish-date
- agent/last-modified-date
- agent/type
- agent/references
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- agent/tags
- agent/event
- vendor/microsoft
- canonical/microsoft windows xp
- version/microsoft windows xp/sp2
- canonical/microsoft windows vista
- canonical/microsoft windows 2000
- version/microsoft windows 2000/sp4
- canonical/microsoft windows server
- version/microsoft windows server/sp2