CVEvulnerability

CVE-2009-0320

4.0 MEDIUM Published 2009-01-28 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-01-28
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:L/AC:H/Au:N/C:C/I:N/A:N
Weaknesses
CWE-200, CWE-362

Description

Microsoft Windows XP, Server 2003 and 2008, and Vista exposes I/O activity measurements of all processes, which allows local users to obtain sensitive information, as demonstrated by reading the I/O Other Bytes column in Task Manager (aka taskmgr.exe) to estimate the number of characters that a different user entered at a runas.exe password prompt, related to a "benchmarking attack."

Affected configurations

• microsoft windows server 2003 • microsoft windows server 2008 • microsoft windows vista • microsoft windows xp

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References