PT-2004-1170 · Microsoft · Windows 2000 Server+3

Published 2004-03-03 · Updated 2019-04-30 · CVE-2003-0825

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 Microsoft Windows NT (affected versions not specified) Microsoft Windows Server 2000 (affected versions not specified)

Description The issue is related to the Windows Internet Naming Service (WINS) not properly validating the length of certain packets. This can allow attackers to cause a denial of service and possibly execute arbitrary code.

Recommendations For Microsoft Windows Server 2003, update to a version that properly validates packet lengths to prevent exploitation. For Microsoft Windows NT and Server 2000, since the affected versions are not specified, ensure that all security updates are applied and consider disabling WINS if it is not necessary for operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability for some of the affected products.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2003-0825

Affected Products

Windows Internet Naming Service

Windows Nt

Windows 2000 Server

Windows Server 2003

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-006 · Vendor Advisory
• http://securityfocus.com/bid/9624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0825 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A801 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A800 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15037 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A704 · Note
• http://osvdb.org/3903 · Note
• http://ciac.org/ciac/bulletins/o-077.shtml · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A802 · Note
• http://kb.cert.org/vuls/id/445214 · Note