CVE-2010-3338
HIGHCVSS Vector
AV:L/AC:L/Au:N/C:C/I:C/A:C
Lifecycle Timeline
3Tags
Description
The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application, aka "Task Scheduler Vulnerability." NOTE: this might overlap CVE-2010-3888.
Analysis
The Windows Task Scheduler in Vista, Server 2008, and Windows 7 contains a privilege escalation vulnerability that allows local users to gain elevated privileges through crafted applications. The scheduler improperly determines the security context for scheduled tasks, enabling attackers to run code with higher privileges than their current user context.
Technical Context
The Windows Task Scheduler fails to properly validate the security context when executing scheduled tasks. A local user can create a crafted application that exploits this validation failure to execute code in the context of a more privileged user or SYSTEM. The vulnerability was notably used by the Stuxnet malware as one of its local privilege escalation components.
Affected Products
['Windows Vista SP1/SP2', 'Windows Server 2008/R2', 'Windows 7']
Remediation
Apply the October 2010 Microsoft security update (MS10-092). Restrict task creation permissions for standard users. Monitor Task Scheduler for unusual task registrations. Upgrade to a supported Windows version.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today