PT-2007-1533 · Microsoft · Windows 2000 Server+3

Published 2007-07-10 · Updated 2019-04-30 · CVE-2007-0040

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 Server version SP4 Microsoft Windows Server 2003 version SP1 Microsoft Windows Server 2003 version SP2 Microsoft Windows Server 2003 x64 Edition version SP2 Microsoft Windows Server 2003 for Itanium-based Systems version SP1 Microsoft Windows Server 2003 for Itanium-based Systems version SP2

Description The issue allows remote attackers to execute arbitrary code via a crafted LDAP request. This is made possible by an unspecified number of "convertible attributes" in the LDAP service within Windows Active Directory.

Recommendations For Microsoft Windows 2000 Server SP4, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 SP1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 x64 Edition SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 for Itanium-based Systems SP1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 for Itanium-based Systems SP2, update to a newer version to mitigate the risk.

Fix

Related Identifiers

CVE-2007-0040

Affected Products

Windows 2000 Server

Windows Server 2003

Windows Server 2003 For Itanium-Based Systems

Windows Server 2003 X64 Edition

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-0040 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-039 · Vendor Advisory
• http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html · Vendor Advisory
• http://iss.net/threats/267.html · Note
• http://kb.cert.org/vuls/id/487905 · Note
• http://vupen.com/english/advisories/2007/2481 · Note
• http://securityfocus.com/bid/24800 · Note
• http://secunia.com/advisories/26002 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2012 · Note
• http://us-cert.gov/cas/techalerts/TA07-191A.html · Note
• http://securitytracker.com/id?1018355 · Note
• http://osvdb.org/35960 · Note