SP4 Server : Security Vulnerabilities

Cpe Name:cpe:/o:microsoft:windows_2000::sp4:server

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2010-1735	20		DoS	2010-05-06	2010-05-11	4.9	None	Local	Low	Not required	None	None	Complete
The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
2	CVE-2010-1734	20		DoS	2010-05-06	2010-05-11	4.9	None	Local	Low	Not required	None	None	Complete
The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
3	CVE-2010-0478	119		Exec Code Overflow	2010-04-14	2010-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote attackers to execute arbitrary code via crafted packets associated with transport information, aka "Media Services Stack-based Buffer Overflow Vulnerability."
4	CVE-2010-0035			DoS	2010-02-10	2010-08-21	6.3	None	Remote	Medium	Single system	None	None	Complete
The Key Distribution Center (KDC) in Kerberos in Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2, when a trust relationship with a non-Windows Kerberos realm exists, allows remote authenticated users to cause a denial of service (NULL pointer dereference and domain controller outage) via a crafted Ticket Granting Ticket (TGT) renewal request, aka "Kerberos Null Pointer Dereference Vulnerability."
5	CVE-2009-2523	119		Exec Code Overflow	2009-11-11	2010-08-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message containing a string without a null terminator, which triggers a heap-based buffer overflow in the LlsrLicenseRequestW method, aka "License Logging Server Heap Overflow Vulnerability."
6	CVE-2009-1928	399		DoS Overflow	2009-11-11	2010-08-21	7.8	None	Remote	Low	Not required	None	None	Complete
Stack consumption vulnerability in the LDAP service in Active Directory on Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2; Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2; and Active Directory Lightweight Directory Service (AD LDS) on Windows Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via a malformed (1) LDAP or (2) LDAPS request, aka "LSASS Recursive Stack Overflow Vulnerability."
7	CVE-2009-1924	189		Exec Code Overflow	2009-08-12	2010-08-21	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partners to execute arbitrary code via crafted data structures in a packet, aka "WINS Integer Overflow Vulnerability."
8	CVE-2009-1923	119		Exec Code Overflow	2009-08-12	2010-08-21	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation, aka "WINS Heap Overflow Vulnerability."
9	CVE-2009-1139	399		DoS	2009-06-10	2010-08-21	7.8	None	Remote	Low	Not required	None	None	Complete
Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service (memory consumption and service outage) via (1) LDAP or (2) LDAPS requests with unspecified OID filters, aka "Active Directory Memory Leak Vulnerability."
10	CVE-2009-1138	399		Exec Code	2009-06-10	2010-08-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN AttributeValue," aka "Active Directory Invalid Free Vulnerability." NOTE: this issue is probably a memory leak.
11	CVE-2008-4609	16		DoS	2008-10-20	2012-07-21	7.1	None	Remote	Medium	Not required	None	None	Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
12	CVE-2008-0088	20		DoS	2008-02-12	2008-09-05	6.8	None	Remote	Low	Single system	None	None	Complete
Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM) on XP and Server 2003, allows remote attackers to cause a denial of service (hang and restart) via a crafted LDAP request.
13	CVE-2007-3028			DoS	2007-07-10	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4 does not properly check "the number of convertible attributes", which allows remote attackers to cause a denial of service (service unavailability) via a crafted LDAP request, related to "client sent LDAP request logic," aka "Windows Active Directory Denial of Service Vulnerability". NOTE: this is probably a different issue than CVE-2007-0040.
14	CVE-2007-2374			Exec Code	2007-04-30	2012-11-05	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is from a reliable source.
15	CVE-2007-1765			DoS Exec Code Mem. Corr.	2007-03-29	2008-09-05	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
16	CVE-2007-1748			Exec Code Overflow	2007-04-13	2008-09-05	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.
17	CVE-2007-0040			Exec Code	2007-07-10	2012-10-30	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."
18	CVE-2006-6696	119		Overflow +Priv	2006-12-21	2009-09-24	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
19	CVE-2006-6296			DoS	2006-12-05	2010-10-14	6.1	None	Local Network	Low	Not required	None	None	Complete
The RpcGetPrinterData function in the Print Spooler (spoolsv.exe) service in Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service (memory consumption) via an RPC request that specifies a large 'offered' value (output buffer size), a variant of CVE-2005-3644.
20	CVE-2006-5988			DoS	2006-11-20	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module. NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116, this disclosure has no actionable information. However, since the VulnDisco Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes.
21	CVE-2006-3880			DoS	2006-07-26	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP stack hang) via a continuous stream of packets on TCP port 135 that have incorrect TCP header checksums and random numbers in certain TCP header fields, as demonstrated by the Achilles Windows Attack Tool. NOTE: the researcher reports that the Microsoft Security Response Center has stated "Our investigation which has included code review, review of the TCPDump, and attempts on reproing the issue on multiple fresh installs of various Windows Operating Systems have all resulted in non confirmation."
22	CVE-2006-3444			Overflow	2006-08-08	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspecified vectors involving an "unchecked buffer."
23	CVE-2006-3443	264		+Priv	2006-08-08	2009-07-23	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4, when SafeDllSearchMode is disabled, allows local users to gain privileges via a malicious DLL in the UserProfile directory, aka "User Profile Elevation of Privilege Vulnerability."
24	CVE-2006-2380	287			2006-06-13	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability."
25	CVE-2006-2379			Exec Code Overflow	2006-06-13	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.
26	CVE-2006-2374	399		DoS	2006-06-13	2010-12-14	2.1	None	Local	Low	Not required	None	None	Partial
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability."
27	CVE-2006-2373	264		Exec Code	2006-06-13	2011-06-14	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
28	CVE-2006-2371			Exec Code Overflow	2006-06-13	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability."
29	CVE-2006-2370			Exec Code Overflow Mem. Corr.	2006-06-13	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability."
30	CVE-2006-1591			Exec Code Overflow	2006-04-03	2008-09-05	5.1	User	Remote	High	Not required	Partial	Partial	Partial
Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
31	CVE-2006-1313			Exec Code Mem. Corr.	2006-06-13	2008-09-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code.
32	CVE-2006-1184			DoS	2006-05-09	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
33	CVE-2006-0143	399		DoS	2006-01-09	2011-09-22	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.
34	CVE-2006-0034	119		Exec Code Overflow	2006-05-09	2011-10-17	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
35	CVE-2006-0032	79		XSS	2006-09-12	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
36	CVE-2006-0012			Exec Code	2006-04-11	2008-09-05	5.1	User	Remote	High	Not required	Partial	Partial	Partial
Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability."
37	CVE-2006-0010	119		Exec Code Overflow	2006-01-10	2008-09-05	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.
38	CVE-2006-0005	119		Exec Code Overflow	2006-02-14	2008-09-10	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.
39	CVE-2005-3981				2005-12-04	2008-09-05	4.9	None	Local	Low	Not required	None	None	Complete
DISPUTED NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly involving an invalid address for the start routine. NOTE: followup posts have disputed this issue, saying that if a user already has privileges to write to a process, then other functions could be called or the process could be terminated using PROCESS_TERMINATE.
40	CVE-2005-3945			DoS	2005-12-01	2008-09-05	7.8	None	Remote	Low	Not required	None	None	Complete
The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values, which slows down the hash table lookups.
41	CVE-2005-3644	399	1	DoS	2005-11-17	2010-10-18	7.8	None	Remote	Low	Not required	None	None	Complete
PNP_GetDeviceList (upnp_getdevicelist) in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a DCE RPC request that specifies a large output buffer size, a variant of CVE-2006-6296, and a different vulnerability than CVE-2005-2120.
42	CVE-2005-2827				2005-12-13	2008-09-10	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability."
43	CVE-2005-2388			Exec Code Overflow	2005-07-27	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.
44	CVE-2005-2307			DoS	2005-07-19	2008-09-10	5.0	None	Remote	Low	Not required	None	None	Partial
netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability."
45	CVE-2005-2122			Exec Code Overflow	2005-10-21	2008-09-10	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118.
46	CVE-2005-2118			Exec Code Overflow	2005-10-21	2008-09-10	5.1	User	Remote	High	Not required	Partial	Partial	Partial
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.
47	CVE-2005-1218			DoS	2005-08-10	2008-09-10	5.0	None	Remote	Low	Not required	None	None	Partial
The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests.
48	CVE-2005-1214			Exec Code	2005-06-14	2008-09-10	5.1	User	Remote	High	Not required	Partial	Partial	Partial
Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
49	CVE-2005-1212			Exec Code Overflow	2005-06-14	2008-09-10	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe) allows remote attackers to execute arbitrary code via a bookmark link file (.cbo, cbl, or .cbm extension) with a long User field.
50	CVE-2005-1191				2005-05-02	2008-09-10	5.0	None	Remote	Low	Not required	None	Partial	None
The Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file.

Total number of vulnerabilities : 97 Page : 1 (This Page)2