PT-2009-3702 · Microsoft · Windows 2000 Sp4+1

Joshua J. Drake · Published 2009-06-10 · Updated 2019-04-30 · CVE-2009-1138

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4

Description The issue is related to the LDAP service in Active Directory, which does not properly free memory for LDAP and LDAPS requests. This allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released. The problem is associated with a "DN AttributeValue" and is probably a memory leak.

Recommendations For Microsoft Windows 2000 SP4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-1138

Affected Products

Active Directory

Windows 2000 Sp4

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1138 · Security Note
• http://secunia.com/advisories/35355 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1537 · Vendor Advisory
• http://securityfocus.com/bid/35226 · Patch
• http://securitytracker.com/id?1022349 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=804 · Note
• http://osvdb.org/54937 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6180 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm · Note