CVE-2009-0080

published 2009-04-15

CVE-2009-0080: The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run…

Priority P2 78 medium 6.9 CVSS 2.0

AV L AC M Au N C C I C A C

ITW EXPLOIT VulnCheck KEV

The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6705.zip↗

• → Monitor for local processes running under NetworkService or LocalService accounts attempting to access resources (handles, threads) belonging to other processes under the same service account — this cross-process resource access is the core exploitation primitive. ↗
• → Alert on privilege escalation to LocalSystem originating from a process previously running as NetworkService or LocalService — successful exploitation results in full LocalSystem privileges. ↗

• · Vulnerability is limited to Windows Vista (Gold and SP1) and Windows Server 2008 only; other Windows versions are not affected. ↗
• · This is a local privilege escalation; an attacker must already have local code execution on the target system to exploit the ThreadPool ACL weakness. ↗

CVSS provenance

nvd v2.0 6.9 MEDIUM AV:L/AC:M/Au:N/C:C/I:C/A:C

vulncheck 6.9 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269