CVE-2003-1233

Critical

Published: 31/12/2003(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

Pedestal Software Integrity Protection Driver (IPD) version 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel. Attackers can use the NtCreateSymbolicLinkObject function to create a symbolic link to physical memory or a drive letter.

Risk Assessment

Organizations may be exposed to unauthorized access to critical system resources, potentially leading to severe security breaches. Exploitation of this vulnerability by malware could result in data loss or system takeover.

Recommendation

It is recommended to update the Integrity Protection Driver to the latest version to mitigate the risks associated with this vulnerability. Additionally, monitoring the system for unauthorized changes and file access is crucial.

Original NVD description (English source)

Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.