CVE-2001-1519

RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it

Affected products

Windows 2000

Microsoft Windows 2000

All versions

Fix

Available

CVSS 2.0

3.6 LOW

EPSS

3.5% (88th percentile)

NVD status

Modified

Published

2005-07-14