PT-2002-2749 · Microsoft · Windows 2000+3

Published 2002-12-31 · Updated 2019-04-30 · CVE-2002-2028

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows NT versions 4.0 Windows 2000 Windows XP Windows 2002

Description The issue concerns the screensaver on Windows operating systems, which fails to verify if a domain account has been locked when a valid password is provided. This oversight makes it easier for individuals with physical access to the system to perform brute force password guessing attacks.

Recommendations For Windows NT 4.0, consider implementing additional security measures to limit login attempts. For Windows 2000, restrict access to the system when not in use to minimize the risk of exploitation. For Windows XP, limit the number of login attempts to prevent brute force attacks. For Windows 2002, enforce strong password policies and consider using alternative authentication methods.

Fix

Related Identifiers

CVE-2002-2028

Affected Products

Windows 2000

Windows 2002

Windows Nt

Windows Xp

References · 5

• http://heysoft.de/nt/lbh.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-2028 · Security Note
• http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq188700 · Vendor Advisory
• http://cert.uni-stuttgart.de/archive/bugtraq/2002/01/msg00278.html · Note
• http://securityfocus.com/bid/3933 · Note