PT-2004-1364 · Microsoft · Windows Xp+1

Donnie Werner · Published 2004-05-14 · Updated 2018-10-12 · CVE-2004-0199

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP and Windows Server 2003 SP1

Description The issue concerns improper validation of HCP URLs in the Help and Support Center, allowing remote attackers to execute arbitrary code. This can be achieved by using certain hcp:// URLs that access the DVD Upgrade capability, specifically dvdupgrd.htm.

Recommendations For Microsoft Windows XP and Windows Server 2003 SP1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0199

Affected Products

Windows Server 2003

Windows Xp

References · 10

• 🔥 http://securityfocus.com/bid/10321 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0199 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-015 · Vendor Advisory
• http://kb.cert.org/vuls/id/484814 · Patch
• http://marc.info/?l=bugtraq&m=108437759930820&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1032 · Note
• http://marc.info/?l=full-disclosure&m=108430407801825&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1008 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16095 · Note
• http://exploitlabs.com/files/advisories/EXPL-A-2004-001-helpctr.txt · Note