CWEweakness

CWE-422 Unprotected Windows Messaging Channel

Official page ↗
Alternate terms
Shatter
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Common consequences

• Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism

Potential mitigations

• [Architecture and Design] Always verify and authenticate the source of the message.

Observed examples

• CVE-2002-0971: Bypass GUI and access restricted dialog box. • CVE-2002-1230: Gain privileges via Windows message. • CVE-2003-0350: A control allows a change to a pointer for a callback function using Windows message. • CVE-2003-0908: Product launches Help functionality while running with raised privileges, allowing command execution using Windows message to access "open file" dialog. • CVE-2004-0213: Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908. • CVE-2004-0207: User can call certain API functions to modify certain properties of privileged programs.

Related

Observed example · CVE (6)

  • CVE-2004-0207 "Shatter" style vulnerability in the Window Management application programming interface (API) for Microsoft Windows 98, Windows NT 4.0,… vulnerability
  • CVE-2004-0213 Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to… vulnerability
  • CVE-2003-0908 The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary… vulnerability
  • CVE-2003-0350 The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle… vulnerability
  • CVE-2002-1230 NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as… vulnerability
  • CVE-2002-0971 Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging… vulnerability

Child of · CWE (2)

  • CWE-360 Trust of System Event Data weakness
  • CWE-420 Unprotected Alternate Channel weakness

Referenced by CVE · weakness (2)

  • CVE-2025-20094 Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. vulnerability
  • CVE-2025-22894 Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. vulnerability