PT-2005-3082 · Microsoft · Windows 2000+1

Jean-Baptiste Marchand · Published 2005-07-11 · Updated 2017-07-11 · CVE-2005-2150

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Windows NT 4.0 Windows 2000 before URP1 for Windows 2000 SP4

Description: The issue allows remote attackers to list Windows services via svcctl or read event logs via eventlog due to improper prevention of NULL sessions from accessing certain alternate named pipes.

Recommendations: For Windows NT 4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Windows 2000 before URP1 for Windows 2000 SP4, apply the URP1 update for Windows 2000 SP4 to resolve the issue.

Related Identifiers

CVE-2005-2150

Affected Products

Windows 2000

Windows Nt 4.0

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-2150 · Security Note
• http://securityfocus.com/bid/14177 · Note
• http://marc.info/?l=bugtraq&m=112076409813099&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21288 · Note
• http://securityfocus.com/bid/14178 · Note
• http://secunia.com/advisories/14189 · Note
• http://hsc.fr/ressources/presentations/null_sessions · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21286 · Note
• http://securitytracker.com/id?1014417 · Note