CVE-2004-1624

Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://marc.info/?l=bugtraq&m=109846296406459&w=2
http://secunia.com/advisories/12962	Vendor Advisory
http://www.securityfocus.com/bid/11500	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17838
http://marc.info/?l=bugtraq&m=109846296406459&w=2
http://secunia.com/advisories/12962	Vendor Advisory
http://www.securityfocus.com/bid/11500	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17838

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:altiris:carbon_copy:5.0:::::::*
	cpe:2.3:a:altiris:carbon_copy:6.0:::::::*

History

No history.

Information

Published : 2004-10-21 04:00

Updated : 2025-04-03 01:03

NVD link : CVE-2004-1624

Mitre link : CVE-2004-1624

CVE.ORG link : CVE-2004-1624

JSON object : View

Products Affected

altiris

carbon_copy

CWE

NVD-CWE-Other

{"id": "CVE-2004-1624", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-10-21T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=109846296406459&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/12962", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11500", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17838", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=109846296406459&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/12962", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/11500", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17838", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe)."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altiris:carbon_copy:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "374C9F53-18BA-4E0A-BF89-B8145E9B2457"}, {"criteria": "cpe:2.3:a:altiris:carbon_copy:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFD35FA6-CB7F-401F-B6BE-AEC9B3710C1A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}