PT-2003-1786 · Microsoft · Windows Server 2003+2

Publicado 2003-10-17 · Atualizado 2019-04-30 · CVE-2003-0660

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Windows NT through Server 2003

Description: The issue concerns the Authenticode capability, which fails to prompt the user to download and install ActiveX controls when the system is low on memory. This could allow remote attackers to execute arbitrary code without user approval.

Recommendations: For Microsoft Windows NT through Server 2003, consider restricting the use of ActiveX controls until a fix is available. As a temporary workaround, ensure that systems have sufficient memory to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2003-0660

Produtos afetados

Activex

Windows Nt

Windows Server 2003

Referências · 8

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A185 · Nota
• http://cert.org/advisories/CA-2003-27.html · Nota
• http://kb.cert.org/vuls/id/838572 · Correção
• http://securityfocus.com/bid/8830 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-0660 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A198 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-041 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13422 · Nota