NetDDE Agent on Windows NT 4.0 4.0 Terminal Server Edition Windows 2000 and Windows XP allows local users to execute arbitrary code as LocalSystem via \shatter\ style attack by sending a WM_COPYDATA message followed by a WM_TIMER message as demonstrated by GetAd aka \Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation.\