{"cvss":0.0,"datePublished":"2009-04-14T00:00:00Z","dateUpdated":"2009-04-14T00:00:00Z","description":"Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.","dueDate":"","id":"CVE-2008-1436","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Windows","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 Privilege Escalation","vendor":"Microsoft"}