{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-06-23T00:00:00", "descriptions": [{"lang": "en", "value": "Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that \"RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "39014", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/39014"}, {"name": "20070626 RE: \"run as\" local denial-of-service enables administrative account processes to be killed", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/472282/100/0/threaded"}, {"name": "20070623 \"run as\" local denial-of-service enables administrative account processes to be killed", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/472216/100/0/threaded"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-3463", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that \"RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "39014", "refsource": "OSVDB", "url": "http://osvdb.org/39014"}, {"name": "20070626 RE: \"run as\" local denial-of-service enables administrative account processes to be killed", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/472282/100/0/threaded"}, {"name": "20070623 \"run as\" local denial-of-service enables administrative account processes to be killed", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/472216/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:21:34.951Z"}, "title": "CVE Program Container", "references": [{"name": "39014", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/39014"}, {"name": "20070626 RE: \"run as\" local denial-of-service enables administrative account processes to be killed", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/472282/100/0/threaded"}, {"name": "20070623 \"run as\" local denial-of-service enables administrative account processes to be killed", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/472216/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-3463", "datePublished": "2007-06-27T18:00:00", "dateReserved": "2007-06-27T00:00:00", "dateUpdated": "2024-08-07T14:21:34.951Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*", "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that \"RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account."}, {"lang": "es", "value": "** IMPUGNADA ** Microsoft Windows XP SP2 permite a usuarios locales, quienes tengan sesiones creadas por otros comandos de usuario RunAs, para matar procesos de su elecci\u00f3n de este otro usuario, como se demostr\u00f3 con el programa taskkill. NOTA: el investigador inidca que hay un conflicto con el vendedor que indica que \"RunAs y UAC son caracter\u00edsticas de conveniencia, no l\u00edmites de seguridad. Si necesitas una garant\u00eda de seguridad, registrar por favor sal del resgitro y vuelvete registrar luego con otra cuenta.\""}], "id": "CVE-2007-3463", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 4.6, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-06-27T18:30:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/39014"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/472216/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/472282/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/39014"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/472216/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/472282/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}