PT-2004-1649 · Microsoft · Windows 2000

Published 2004-06-08 · Updated 2008-09-05 · CVE-2004-0540

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000

Description The issue occurs when Microsoft Windows 2000 is running in a domain with a Fully Qualified Domain Name (FQDN) that is exactly 8 characters long. In this scenario, the system fails to prevent users with expired passwords from logging on to the domain.

Recommendations For Microsoft Windows 2000, consider implementing a workaround to enforce password expiration policies, such as manually tracking and disabling accounts with expired passwords until a more permanent solution can be applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0540

Affected Products

Windows 2000

References · 3

• http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B830847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0540 · Security Note
• http://secunia.com/advisories/11746 · Note