Microsoft » Windows Nt : Security Vulnerabilities, CVEs,

Teardrop IP denial of service.

Land IP denial of service.

Listening TCP ports are sequentially allocated, allowing spoofing attacks.

Predictable TCP sequence numbers allow spoofing.

A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.

Windows NT 4.0 beta allows users to read and delete shares.

Denial of service in RAS/PPTP on NT systems.

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share.

Denial of service in Windows NT messenger service through a long username.

Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size.

Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.

Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service.

Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT.

Windows NT RSHSVC program allows remote users to execute arbitrary commands.

Buffer overflow in War FTP allows remote execution of commands.

Bonk variation of teardrop IP fragmentation denial of service.

Denial of service in Windows NT DNS servers through malicious packet which contains a response to a query that wasn't made.

Denial of service in Windows NT DNS servers by flooding port 53 with too many characters.

In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.

Denial of service in telnet from the Windows NT Resource Kit, by opening then immediately closing a connection.

The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service), as demonstrated via a flood of random packets.

Denial of service through Winpopup using large user names.

NT users can gain debug-level access on a system process using the Sechole exploit.

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value.