CVE-2008-1436

published 2008-04-21

CVE-2008-1436: Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService…

Priority P2 74 critical 9 CVSS 2.0

AV N AC L Au S C C I C A C

ITW EXPLOIT VulnCheck KEV

Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows-nt	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6705.zip↗

• → Monitor for abuse of SeImpersonatePrivilege on service accounts (NetworkService, LocalService) — a process running under these accounts acquiring SeImpersonatePrivilege and then impersonating a LocalSystem-level token is the core exploitation pattern for Token Kidnapping. ↗
• → Alert on privilege escalation attempts where an authenticated user or service (e.g., IIS worker process) elevates to NetworkService or beyond; monitor IIS-related process trees for unexpected token impersonation. ↗
• → The exploit is publicly known as 'Token Kidnapping' — hunt for process injection or handle duplication from NetworkService/LocalService processes targeting SYSTEM-level tokens. ↗

• · Affected platforms are specifically Windows XP Professional SP2, Vista, Server 2003, and Server 2008 — exploitation requires an authenticated context (e.g., a compromised service account) and is not a remote unauthenticated vector. ↗
• · The vulnerability is originally reported in the context of IIS; detection logic should prioritise IIS worker processes (w3wp.exe) as the initial exploitation vector. ↗

CVSS provenance

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

vulncheck 9.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264