PT-2007-4296 · Microsoft · Windows Server 2003

Published 2007-06-04 · Updated 2012-11-06 · CVE-2007-2999

Positive Technologies (AI Summary)

CVSS v2.0

1.8

Low

Base vector

AV:A/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Server 2003

Description: The issue allows context-dependent attackers to determine valid Active Directory account names by generating different error messages for failed login attempts with a valid user name than for those with an invalid user name when time restrictions are in effect for user accounts.

Recommendations: For Microsoft Windows Server 2003, consider implementing additional authentication logging and monitoring to detect and respond to potential attacks, and restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2999

Affected Products

Windows Server 2003

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-2999 · Security Note
• http://secunia.com/advisories/25457 · Vendor Advisory
• http://osvdb.org/36138 · Note
• http://securityfocus.com/bid/24248 · Note
• http://notsosecure.com/folder2/2007/05/27/logon-time-restrictions-in-a-domain-in-windows-server-2003-allows-username-enumeration · Note