PT-2001-1241 · Microsoft · Internet Explorer+4

Published 2001-02-12 · Updated 2018-10-12 · CVE-2001-0003

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Office 2000 Windows 2000 Windows Me

Description: The issue arises from the Web Extender Client (WEC) not properly processing Internet Explorer security settings for NTLM authentication. This allows attackers to obtain NTLM credentials and possibly the password.

Recommendations: For Microsoft Office 2000, consider disabling NTLM authentication until a patch is available. For Windows 2000, restrict access to the Web Extender Client (WEC) to minimize the risk of exploitation. For Windows Me, avoid using the Web Extender Client (WEC) for NTLM authentication until the issue is resolved.

Fix

Related Identifiers

CVE-2001-0003

Affected Products

Internet Explorer

Office 2000

Web Extender Client

Windows 2000

Windows Me

References · 4

• http://securityfocus.com/bid/2199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0003 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-001 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5920 · Note