Unscored severity · published Dec 4, 2005
CVE-2005-3981
NOTE: this issue has been disputed by third parties
–
CVSS
3.6%
EPSS
No
On KEV
Description
NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly involving an invalid address for the start routine. NOTE: followup posts have disputed this issue, saying that if a user already has privileges to write to a process, then other functions could be called or the process could be terminated using PROCESS_TERMINATE
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W2
Windows 2000 · Microsoft
All versions, or not specified · source: NVD
W2
Windows 2003 Server · Microsoft
enterprise; enterprise; r2; r2; standard; standard; +2 more · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3981
www.securityfocus.com
http://www.securityfocus.com/archive/1/418289/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/418431/100/0/threaded
Exploit
http://www.securityfocus.com/bid/15671/
More from Windows 2000
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability
8.8
CVE-2009-1537
Microsoft DirectX NULL Byte Overwrite Vulnerability
7.8
CVE-2010-0232
Microsoft Windows Kernel Exception Handler Vulnerability
7.8
CVE-2009-1123
Microsoft Windows Improper Input Validation Vulnerability
7.8
CVE-2004-0210
Microsoft Windows Privilege Escalation Vulnerability
