Vulnerability CVE-2004-0900

Vulnerability Name:

CVE-2004-0900 (CCN-18342)

Assigned:

2004-12-14

Published:

2004-12-14

Updated:

2018-10-12

Summary:

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2004-0900

Source: CCN
Type: Microsoft Security Bulletin MS04-042
Vulnerability in DHCP Could Allow Remote Code Execution and Denial Of Service (885249)

Source: CCN
Type: BID-11920
Microsoft Windows DHCP Server Remote Buffer Overflow Vulnerability

Source: MS
Type: UNKNOWN
MS04-042

Source: XF
Type: UNKNOWN
winnt-dhcp-hardwareaddress-code-execution(18342)

Source: XF
Type: UNKNOWN
winnt-dhcp-hardwareaddress-code-execution(18342)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:3577

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:4846

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:terminal_server_alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:alpha:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:x86:*

Configuration CCN 1:

cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:terminal_server:*:x86:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:3577	V	Windows NT DHCP Request Code Execution Vulnerability	2008-03-24
oval:org.mitre.oval:def:4846	V	Windows NT DHCP Request Code Execution Vulnerability (Terminal Server)	2008-03-24

BACK