Description
The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Windows Utility Manager - Local Privilege Escalation (MS04-011) EDB-271 · local · Apr 15, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 10124 vdb-entry
- O-114 third-party-advisory government-resource
- win2k-utilitymgr-gain-privileges(15632) vdb-entry
- http://www.appsecinc.com/resources/alerts/general/04-0001.html
- MS04-011 vendor-advisory
- VU#526084 third-party-advisory
- TA04-104A third-party-advisory
- http://www.securiteam.com/windowsntfocus/5LP0C2ACKU.html
- 20040414 [SHATTER Team Security Alert] Microsoft Windows Utility Manager Vulnerability mailing-list
- oval:org.mitre.oval:def:1046 vdb-entry signature