Vulnerability Name:

CVE-2004-0574 (CCN-17641)

Assigned:2004-10-12
Published:2004-10-12
Updated:2020-04-09
Summary:The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2004-0574

Source: BUGTRAQ
Type: Mailing List, Third Party Advisory
20041012 CORE-2004-0802: IIS NNTP Service XPAT Command Vulnerabilities

Source: CCN
Type: CIAC Information Bulletin P-012
Microsoft Vulnerability in NNTP Could Allow Remote Code Execution (883935)

Source: CIAC
Type: Broken Link
P-012

Source: CCN
Type: Core Security Technologies Advisory CORE-2004-0802
IIS NNTP Service XPAT Command Vulnerabilities

Source: MISC
Type: Third Party Advisory
http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10

Source: CCN
Type: US-CERT VU#203126
Microsoft IIS contains vulnerability in NNTP service

Source: CERT-VN
Type: Patch, Third Party Advisory, US Government Resource
VU#203126

Source: CCN
Type: Microsoft Security Bulletin MS04-036
Vulnerability in NNTP Could Allow Code Execution (883935)

Source: CCN
Type: BID-11379
Microsoft NNTP Component Heap Overflow Vulnerability

Source: MS
Type: Patch, Vendor Advisory
MS04-036

Source: XF
Type: Third Party Advisory, VDB Entry
win-nntp-bo(17641)

Source: XF
Type: UNKNOWN
win-nntp-bo(17641)

Source: XF
Type: Third Party Advisory, VDB Entry
win-ms04036-patch(17661)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:246

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:4392

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:5021

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:5070

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:5926

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:exchange_server:2000:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2003:-:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:microsoft:windows_2000:-:-:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:server:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:r2:-:*:*:-:*:-:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows_2000:-:sp3:*:*:server:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:x86:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:server:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2003:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2003:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:5926
    V
    		Windows 2000 NNTP Component Buffer Overflow
    2016-02-19
    oval:org.mitre.oval:def:4392
    V
    		Windows Server 2003 NNTP Component Buffer Overflow
    2016-02-19
    oval:org.mitre.oval:def:5070
    V
    		Windows NT NNTP Component Buffer Overflow
    2016-02-19
    oval:org.mitre.oval:def:246
    V
    		Network News Transfer Protocol Buffer Overflow
    2007-11-13
    oval:org.mitre.oval:def:5021
    V
    		Vulnerability in NNTP Could Allow Remote Code Execution
    2007-11-13
    BACK
    microsoft exchange server 2000 -
    microsoft exchange server 2003 -
    microsoft windows 2000 - -
    microsoft windows nt 4.0
    microsoft windows server 2003 r2
    microsoft windows 2000 - sp3
    microsoft windows nt 4.0 sp6a
    microsoft windows 2003_server
    microsoft windows 2003 server *
    microsoft windows 2000 - sp4
    microsoft exchange server 2003 sp1
    microsoft exchange server 2000 sp3
    microsoft exchange server 2003