CVE-2004-0119

Description

The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products

Microsoft / windows_2000
Microsoft / windows_server_2003
Microsoft / windows_xp

References

MISChttp://www.ciac.org/ciac/bulletins/o-114.shtml
MISChttp://www.kb.cert.org/vuls/id/638548
MISChttp://www.securityfocus.com/bid/10113
MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/15715
MISChttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011
MISChttp://archives.neohapsis.com/archives/vulnwatch/2004-q1/0081.html
MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1808
MISChttp://www.us-cert.gov/cas/techalerts/TA04-104A.html
MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1962
MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1997