4 20050803235300 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED 'The Exchange 2003 Exadmin virtual directory uses only Integrated Windows Authentication.' 2.1.6 ACCEPTED 1 Corresponds to item 2.1.6 in the Exchange 2003 Benchmark Microsoft Windows 2000 Internet Explorer 5.5 Service Pack 2 David Proulx Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. CVE-2002-0026 ACCEPTED 3 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. CVE-2002-0079 ACCEPTED 3 Microsoft Windows 2000 Internet Explorer 6.0 David Proulx Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. CVE-2002-0023 ACCEPTED 3 Microsoft Windows NT Windows Shell Matthew Burton Matthew Burton DRAFT INTERIM Matthew Burton ACCEPTED Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled. CVE-2002-0070 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6.0 Andrew Buttner Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability. CAN-2002-0189 ACCEPTED 3 Microsoft Windows 2000 Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0528. CAN-2003-0715 ACCEPTED 2 Microsoft Windows 2000 Internet Information Server 5.0 Andrew Buttner ACCEPTED Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." CVE-2002-0147 ACCEPTED 4 Microsoft Windows 2000 Internet Explorer 5.5 or Internet Explorer 5.5 Service Pack 1 David Proulx Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. CVE-2002-0026 ACCEPTED 3 Microsoft Windows NT FTP Tiffany Bergeron The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. CVE-2002-0073 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. CVE-2002-0079 ACCEPTED 3 Microsoft Windows 2000 Network Connection Manager (NCM) Christine Walzer Christine Walzer INTERIM ACCEPTED A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code. CVE-2002-0720 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.01 Tiffany Bergeron Christine Walzer INTERIM ACCEPTED Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability. CVE-2002-0193 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." CVE-2002-0364 ACCEPTED 4 Microsoft Windows 2000 SMTP Tiffany Bergeron Andrew Buttner SMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 to cause a denial of service via a command with a malformed data transfer (BDAT) request. CVE-2002-0055 ACCEPTED 3 Microsoft Windows 2000 Internet Explorer 6.0 David Proulx Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. CVE-2002-0026 ACCEPTED 3 Microsoft Windows 2000 FTP Tiffany Bergeron The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. CVE-2002-0073 ACCEPTED 4 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. CVE-2001-0333 ACCEPTED 2 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access. CVE-2002-0051 ACCEPTED 2 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. CVE-2002-0150 ACCEPTED 3 Microsoft Windows 2000 Internet Explorer 5.5 Service Pack 2 David Proulx Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. CVE-2002-0023 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability. CVE-2000-0884 ACCEPTED 2 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. CVE-2002-0071 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. CVE-2002-0074 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.01 David Proulx Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." CVE-2003-1326 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.01, Internet Explorer 5.01 Service Pack 1, or Internet Explorer 5.01 Service Pack 2 David Proulx Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. CVE-2002-0023 ACCEPTED 3 Microsoft Windows 2000 Internet Explorer 6.0 David Proulx The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality." CVE-2003-1328 ACCEPTED 2 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. CVE-2002-0075 ACCEPTED 1 Microsoft Windows 2000 Remote Procedure Call (RPC) Tiffany Bergeron Christine Walzer INTERIM ACCEPTED The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference. CAN-2002-1561 ACCEPTED 2 Microsoft Windows NT Remote Access Service (RAS) Tiffany Bergeron Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry. CVE-2002-0366 ACCEPTED 1 Microsoft Windows 2000 Remote Access Service (RAS) Tiffany Bergeron Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry. CVE-2002-0366 ACCEPTED 2 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Tiffany Bergeron ACCEPTED INTERIM ACCEPTED In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which could allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain. CVE-2002-0018 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 David Proulx Christine Walzer INTERIM ACCEPTED Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message. CAN-2003-0223 ACCEPTED 2 Microsoft Windows 2000 Microsoft SQL Server 2000 Yi-Fang Koh ACCEPTED Jonathan Baker Jonathan Baker INTERIM ACCEPTED An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account. CVE-2001-0344 ACCEPTED 2 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." CVE-2002-0147 ACCEPTED 3 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit. CVE-2002-0367 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.5 or Internet Explorer 5.5 Service Pack 1 David Proulx Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. CVE-2002-0023 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron Tiffany Bergeron ACCEPTED INTERIM ACCEPTED Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. CVE-2001-0333 ACCEPTED 3 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. CVE-2002-0148 ACCEPTED 1 Microsoft Windows 2000 Microsoft SQL Server 2000 Tiffany Bergeron Jonathan Baker INTERIM Ingrid Skoog ACCEPTED Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs. CAN-2001-0509 ACCEPTED 2 Microsoft Windows 2000 Microsoft SQL Server Yi-Fang Koh Ingrid Skoog INTERIM ACCEPTED Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CAN-2001-0879. CAN-2001-0542 ACCEPTED 2 Microsoft Windows NT Simple Network Management Protocol (SNMP) Harvey Rubinovitz Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. CAN-2002-0013 ACCEPTED 1 Microsoft Windows 2000 Multiple UNC Provider (MUP) Tiffany Bergeron Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request. CVE-2002-0151 ACCEPTED 2 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron INTERIM Ingrid Skoog ACCEPTED IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests. CVE-2001-0151 ACCEPTED 3 Microsoft Windows 2000 Internet Information Server 5.0 Harvey Rubinovitz Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. CVE-2002-0148 ACCEPTED 1 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. CVE-2002-0149 ACCEPTED 3 Microsoft Windows 2000 Internet Explorer 6.0 Andrew Buttner Andrew Buttner INTERIM ACCEPTED The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability. CVE-2002-0078 ACCEPTED 4 Microsoft Windows 2000 Internet Explorer 6.0 David Proulx Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response. CAN-2002-0371 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 6.0 Andrew Buttner Christine Walzer INTERIM ACCEPTED Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability. CVE-2002-0193 ACCEPTED 4 Microsoft Windows NT Locator service Tiffany Bergeron Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information. CVE-2003-0003 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0. CAN-2003-0109 ACCEPTED 2 Microsoft Windows 2000 ISA Server 2000 Tiffany Bergeron ACCEPTED Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found." CAN-2003-0526 ACCEPTED 1 Microsoft Windows 2000 SMB (Server Message Block) Tiffany Bergeron ACCEPTED Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. CAN-2003-0345 ACCEPTED 1 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. CAN-2002-0154 ACCEPTED 2 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Tiffany Bergeron ACCEPTED Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page. CAN-2003-0809 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6.0 Andrew Buttner Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." CVE-2003-1326 ACCEPTED 2 Microsoft Windows 2000 Remote Procedure Call (RPC) Tiffany Bergeron ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0715. CAN-2003-0528 ACCEPTED 1 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. CVE-2002-0071 ACCEPTED 3 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. CVE-2002-0149 ACCEPTED 3 Microsoft Windows 2000 Windows Script Engine for Jscript DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. CAN-2003-0010 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Virtual Machine (VM) Tiffany Bergeron INTERIM ACCEPTED The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could Enable System Compromise." CAN-2003-0111 ACCEPTED 1 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. CVE-2002-0150 ACCEPTED 3 Microsoft Windows NT Simple Network Management Protocol (SNMP) Matt Busby INTERIM ACCEPTED The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" vulnerabilities. CAN-2001-0046 ACCEPTED 1 Microsoft Windows NT Microsoft Transaction Server (MTS) Matt Busby INTERIM ACCEPTED The default permissions for the MTS Package Administration registry key in Windows NT 4.0 allows local users to install or modify arbitrary Microsoft Transaction Server (MTS) packages and gain privileges, aka one of the "Registry Permissions" vulnerabilities. CAN-2001-0047 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.01, Internet Explorer 5.01 Service Pack 1 Tiffany Bergeron Andrew Buttner ACCEPTED HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly. CVE-2001-0154 ACCEPTED 2 Microsoft Windows NT Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." CVE-2002-1186 ACCEPTED 1 Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Harvey Rubinovitz Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. CAN-2002-0012 ACCEPTED 1 Microsoft Windows NT Multiple UNC Provider (MUP) Tiffany Bergeron Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request. CVE-2002-0151 ACCEPTED 1 Microsoft Windows NT SMB (Server Message Block) Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. CAN-2003-0345 ACCEPTED 2 Microsoft Windows 2000 Windows Shell Christine Walzer Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled. CVE-2002-0070 ACCEPTED 1 Microsoft Windows NT Windows NT 4.0 Tiffany Bergeron smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit. CVE-2002-0367 ACCEPTED 1 Microsoft Windows NT Windows NT 4.0 Tiffany Bergeron In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which could allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain. CVE-2002-0018 ACCEPTED 1 Microsoft Windows NT Simple Network Management Protocol (SNMP) Harvey Rubinovitz Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. CAN-2002-0012 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.5 Andrew Buttner Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." CVE-2003-1326 ACCEPTED 2 Microsoft Windows NT Internet Information Server 4.0 Tiffany Bergeron ACCEPTED Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." CVE-2002-0364 ACCEPTED 3 Microsoft Windows XP Authenticode Tiffany Bergeron Andrew Buttner Andrew Buttner ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval. CAN-2003-0660 ACCEPTED 2 Microsoft Windows 2000 Microsoft Word 2000 Christine Walzer Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word 2002, 2000, 97, and 98(J) does not properly check certain properties of a document, which allows attackers to bypass the macro security model and automatically execute arbitrary macros via a malicious document. CAN-2003-0664 ACCEPTED 2 Microsoft Windows 2000 SMB (Server Message Block) Christine Walzer Christine Walzer INTERIM ACCEPTED Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service". CAN-2002-0724 ACCEPTED 2 Microsoft Windows 2000 Certificate Enrollment Control Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED Unknown vulnerability in the Certificate Enrollment ActiveX Control in Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000, and Windows XP allow remote attackers to delete digital certificates on a user's system via HTML. CAN-2002-0699 ACCEPTED 2 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. CVE-2000-0886 ACCEPTED 3 Microsoft Windows NT Remote Procedure Call (RPC) Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. CAN-2003-0352 ACCEPTED 2 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron Tiffany Bergeron ACCEPTED Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red. CVE-2001-0500 ACCEPTED 3 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Tiffany Bergeron ACCEPTED The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval. CAN-2003-0660 ACCEPTED 1 Microsoft Windows 2000 Remote Data Protocol (RDP) Tiffany Bergeron Christine Walzer INTERIM ACCEPTED Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol." CAN-2002-0863 ACCEPTED 3 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Windows Script Engine for JScript v5.6 Tiffany Bergeron David Proulx David Proulx ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. CAN-2003-0010 ACCEPTED 3 Microsoft Windows XP Windows XP Tiffany Bergeron Andrew Buttner ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM INTERIM ACCEPTED Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application. CAN-2003-0659 ACCEPTED 3 Microsoft Windows 2000 Microsoft Word 2000 Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure." CAN-2002-1143 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz ACCEPTED Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the &lt;frame&gt; or &lt;iframe&gt; element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource. CVE-2002-1187 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Andrew Buttner ACCEPTED Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CAN-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe). CAN-2003-0838 ACCEPTED 1 Microsoft Windows 2000 Microsoft Word 2000 Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to. CVE-2002-1056 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Tiffany Bergeron DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifiying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. CAN-2004-0549 ACCEPTED 2 Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Tiffany Bergeron Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CAN-2002-0012 and CAN-2002-0013, will be updated when more accurate information is available. CAN-2002-0053 ACCEPTED 1 Microsoft Windows 2000 Internet Information Server 5.0 Harvey Rubinovitz Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. CVE-2002-0075 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows 2000 Messenger Service Christine Walzer ACCEPTED Andrew Buttner ACCEPTED The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0717 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Ingrid Skoog DRAFT INTERIM ACCEPTED Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. CAN-2004-0566 ACCEPTED 1 Microsoft Windows 2000 Help and Support Center (HSC) Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL CAN-2003-0711 ACCEPTED 3 Microsoft Windows NT DirectX Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow. CAN-2003-0346 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the &lt;frame&gt; or &lt;iframe&gt; element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource. CVE-2002-1187 ACCEPTED 1 Microsoft Windows 2000 Microsoft SQL Server Tiffany Bergeron Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM Ingrid Skoog ACCEPTED The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. CAN-2000-1081 ACCEPTED 2 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Jonathan Baker INTERIM INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Microsoft SQL Server 7, 2000, and MSDE allows local users go gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability CAN-2003-0230 ACCEPTED 3 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron Andrew Buttner ACCEPTED Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML formatter e-mail or web page. CAN-2003-0662 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Tiffany Bergeron DRAFT INTERIM ACCEPTED The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifiying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. CAN-2004-0549 ACCEPTED 1 Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) Christine Walzer DRAFT INTERIM ACCEPTED The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. CAN-2004-0574 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Yi-Fang Koh Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service. CVE-2001-0879 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. CAN-2005-1211 INTERIM 0 Microsoft Windows Server 2003 SMB (Server Message Block) Jonathan Baker DRAFT INTERIM Buffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability." CAN-2005-1206 INTERIM 0 Microsoft Windows 2000 Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 2 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0528. CAN-2003-0715 ACCEPTED 1 Microsoft Windows XP Client Server Runtime System (CSRSS) Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0551 ACCEPTED 1 Microsoft Windows XP Windows XP Tiffany Bergeron Andrew Buttner ACCEPTED Christine Walzer INTERIM ACCEPTED The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0717 ACCEPTED 2 Microsoft Windows 2000 Microsoft SQL Server 2000 Yi-Fang Koh Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection. CAN-2002-0056 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz ACCEPTED Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses &lt;frame&gt; and &lt;iframe&gt; domain restrictions. CAN-2002-1217 ACCEPTED 1 Microsoft Windows 2000 SMB Signing (Server Message Block) Christine Walzer ACCEPTED The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller. CVE-2002-1256 ACCEPTED 1 Microsoft Windows XP Windows Media Player for Windows XP Tiffany Bergeron ACCEPTED Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player". CVE-2002-0372 ACCEPTED 1 Microsoft Windows XP Windows Media Player for Windows XP Tiffany Bergeron ACCEPTED Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file. CVE-2001-0719 ACCEPTED 1 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure." CAN-2002-0624 ACCEPTED 2 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.6 Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. CVE-2002-1142 ACCEPTED 2 Microsoft Windows 2000 Remote Procedure Call (RPC) Tiffany Bergeron ACCEPTED Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. CAN-2003-0352 ACCEPTED 1 Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. CAN-2002-0013 ACCEPTED 2 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe CAN-2003-0231 ACCEPTED 3 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow CAN-2003-0232 ACCEPTED 3 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Ingrid Skoog DRAFT INTERIM ACCEPTED Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. CAN-2004-0566 ACCEPTED 1 Microsoft Windows 2000 Microsoft FrontPage Server Extensions 2000 Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. CAN-2003-0824 ACCEPTED 1 Microsoft Windows 2000 SQL Server 2000 Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query. CAN-2002-0641 ACCEPTED 2 Microsoft Windows NT Windows NT 4.0 Tiffany Bergeron INTERIM ACCEPTED The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method. CAN-2003-0525 ACCEPTED 2 Microsoft Windows XP Windows Media Player for Windows XP Tiffany Bergeron ACCEPTED Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location. CAN-2003-0228 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Ingrid Skoog DRAFT INTERIM ACCEPTED Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. CAN-2004-0566 ACCEPTED 1 Microsoft Windows XP Microsoft Color Management Module Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1219 DRAFT 0 Microsoft Windows XP Microsoft Windows Workstation Service Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API. CAN-2003-0812 ACCEPTED 2 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses &lt;frame&gt; and &lt;iframe&gt; domain restrictions. CAN-2002-1217 ACCEPTED 1 Microsoft Windows 2000 Network News Transport Protocol (NNTP) Christine Walzer ACCEPTED Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts. CVE-2001-0543 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2000 Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0820 ACCEPTED 2 Microsoft Windows 2000 Windows 2000 Tiffany Bergeron ACCEPTED Christine Walzer INTERIM INTERIM ACCEPTED Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application. CAN-2003-0659 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows XP Microsoft FrontPage Server Extensions 2000 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions 2000 and 2002 allows remote attackers to execute arbitrary code via a certain chunked encoded request. CAN-2003-0822 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft FrontPage Server Extensions 2002 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions 2000 and 2002 allows remote attackers to execute arbitrary code via a certain chunked encoded request. CAN-2003-0822 ACCEPTED 2 Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft SharePoint Team Services Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions 2000 and 2002 allows remote attackers to execute arbitrary code via a certain chunked encoded request. CAN-2003-0822 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron Christine Walzer INTERIM ACCEPTED The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page. CAN-2003-0225 ACCEPTED 2 Microsoft Windows 2000 HTML Help ActiveX Control Christine Walzer Andrew Buttner ACCEPTED Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function. CAN-2002-0693 ACCEPTED 1 Microsoft Windows Server 2003 HTML Help Facility Andrew Buttner DRAFT INTERIM Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer. CAN-2005-1208 INTERIM 0 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz ACCEPTED Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." CAN-2002-1254 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. CAN-2003-0814 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure." CVE-2002-1185 ACCEPTED 1 Microsoft Windows NT Simple Network Management Protocol (SNMP) Matt Busby Matthew Burton DRAFT INTERIM ACCEPTED Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CAN-2002-0012 and CAN-2002-0013, will be updated when more accurate information is available. CAN-2002-0053 ACCEPTED 1 Microsoft Windows 2000 HTML Help Facility Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File." CVE-2002-0694 ACCEPTED 2 Microsoft Windows 2000 ISA Server 2000 Tiffany Bergeron ACCEPTED The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745. CAN-2003-0110 ACCEPTED 0 Microsoft Windows Server 2003 Windows Shell Harvey Rubinovitz DRAFT INTERIM ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." CAN-2002-1254 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows 2000 Telnet protocol Christine Walzer Christine Walzer INTERIM ACCEPTED Buffer overflow in telnet server in Windows 2000 and Interix 2.2 allows remote attackers to execute arbitrary code via malformed protocol options. CVE-2002-0020 ACCEPTED 2 Microsoft Windows 2000 Microsoft Word 2002 Ingrid Skoog DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to CVE-2002-1056 ACCEPTED 2 Microsoft Windows XP Microsoft Color Management Module Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1219 DRAFT 0 Microsoft Windows 2000 Internet Explorer 6.0 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading." CVE-2002-1188 ACCEPTED 1 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 1 Microsoft Windows 2000 Utilities Manager/Windows Messaging Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages, which allows local users to execute arbitrary code via a "Shatter" style message to the Utility Manager that references a user-controlled callback function. CAN-2003-0350 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 2 Microsoft Windows 2000 HTML Help Facility Andrew Buttner DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1208 INTERIM 0 Microsoft Windows 2000 Small Business Server 2000 Jonathan Baker DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1206 INTERIM 0 Microsoft Windows 2000 ISA Server 2000 Christine Walzer DRAFT INTERIM Microsoft ISA Server 2000 allows remote attackers to connect to services utilizing the NetBIOS protocol via a NetBIOS connection with an ISA Server that uses the NetBIOS (all) predefined packet filter. CAN-2005-1216 INTERIM 0 Microsoft Windows 2000 Internet Explorer 5.01 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." CVE-2002-1186 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. CAN-2003-0815 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Andrew Buttner INTERIM ACCEPTED Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed. CAN-2003-0904 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Internet Security and Acceleration Server 2000 David Proulx INTERIM ACCEPTED Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. CAN-2003-0819 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Microsoft Internet Explorer 6 Service Pack 1 Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. CAN-2003-0816 ACCEPTED 1 Microsoft Windows 2000 Internet Information Server 5.0 Tiffany Bergeron ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun." CAN-2003-0224 ACCEPTED 2 Microsoft Windows 2000 Microsoft SQL Server 2000 Matthew Burton Matthew Burton Matthew Burton DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension. CVE-2002-0186 ACCEPTED 2 Microsoft Windows 2000 Microsoft SQL Server 2000 Matthew Burton Matthew Burton DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." CVE-2002-0186 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows 2000 Remote Procedure Call (RPC) Tiffany Bergeron ACCEPTED The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function. CAN-2003-0605 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." CVE-2002-1186 ACCEPTED 1 Microsoft Windows NT Remote Access Service (RAS) Matt Busby INTERIM ACCEPTED The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities. CAN-2001-0045 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Ingrid Skoog DRAFT INTERIM ACCEPTED Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. CAN-2004-0566 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Ingrid Skoog DRAFT INTERIM ACCEPTED Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. CAN-2004-0566 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 2 Microsoft Windows XP Microsoft Internet Explorer 6 Tiffany Bergeron DRAFT INTERIM ACCEPTED The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifiying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. CAN-2004-0549 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Data Access Compnents 2.5 Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. CVE-2003-0903 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." CAN-2003-1025 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 1 Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure." CVE-2002-1185 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Microsoft Internet Explorer 6 Service Pack 1 Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Data Access Compnents 2.6 Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. CVE-2003-0903 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. CAN-2003-0817 ACCEPTED 2 Microsoft Windows XP Windows Shell Harvey Rubinovitz DRAFT INTERIM ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Workstation Service Tiffany Bergeron ACCEPTED Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API. CAN-2003-0812 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Virtual Machine (VM) Tiffany Bergeron INTERIM ACCEPTED Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error. CAN-2002-1258 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 97 Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM Ingrid Skoog Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0820 INTERIM 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 98 Andrew Buttner INTERIM ACCEPTED Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0820 ACCEPTED 1 Microsoft Windows Server 2003 Windows Shell Harvey Rubinovitz DRAFT INTERIM ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 2 Microsoft Windows NT Microsoft FrontPage Server Extensions 2000 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. CAN-2003-0824 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP MSN Messenger Christine Walzer DRAFT INTERIM ACCEPTED Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. CAN-2004-0597 ACCEPTED 1 Microsoft Windows Server 2003 Services for UNIX Jonathan Baker DRAFT INTERIM The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. CAN-2005-1205 INTERIM 0 Microsoft Windows XP Microsoft FrontPage Server Extensions 2000 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. CAN-2003-0824 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6.0 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. CVE-2002-0648 INTERIM 0 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft FrontPage Server Extensions 2002 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. CAN-2003-0824 INTERIM 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CAN-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." CAN-2003-1027 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 2 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2000 Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. CAN-2003-0821 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows NT MDAC 2.8 Ingrid Skoog DRAFT INTERIM ACCEPTED The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." CAN-2005-0050 ACCEPTED 1 Microsoft Windows 2000 Microsoft ASN.1 Library Andrew Buttner INTERIM ACCEPTED Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. CAN-2003-0818 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2002 Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2003-0820 ACCEPTED 2 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 97 Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. CAN-2003-0821 INTERIM 1 Microsoft Windows NT NetDDE Agent Ingrid Skoog DRAFT INTERIM ACCEPTED NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation." CVE-2002-1230 ACCEPTED 1 Microsoft Windows 2000 Microsoft Agent Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. CAN-2005-1214 INTERIM 0 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Review blocked recipient list 1.2.7 ACCEPTED 1 Corresponds to item 1.2.7 in the Exchange 2003 Benchmark Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM Jonathan Baker Ingrid Skoog ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Review the global accept and deny lists. 1.2.1 ACCEPTED 1 Corresponds to item 1.2.1 in the Exchange 2003 Benchmark Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 5.5 Harvey Rubinovitz ACCEPTED Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading." CVE-2002-1188 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2002 Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. CAN-2003-0821 ACCEPTED 2 Microsoft Windows NT Microsoft FrontPage Server Extensions 2000 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions 2000 and 2002 allows remote attackers to execute arbitrary code via a certain chunked encoded request. CAN-2003-0822 ACCEPTED 1 Microsoft Windows 2000 Windows Internet Naming Service (WINS) Andrew Buttner INTERIM ACCEPTED The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. CVE-2003-0825 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." CAN-2005-0055 ACCEPTED 1 Microsoft Windows NT Windows Animated Cursor Christine Walzer DRAFT INTERIM ACCEPTED The Windows Animated Cursor (ANI) in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to cause a denial of service (kernel crash or resource consumption) via the (1) frame number or (2) rate number set to zero CAN-2004-1305 ACCEPTED 1 Microsoft Windows 2000 Hyperlink Object Library Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0057 ACCEPTED 1 Microsoft Windows Server 2003 Web Client Service Matthew Burton DRAFT Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. CAN-2005-1207 DRAFT 0 Microsoft Windows XP Microsoft Internet Explorer 6 Microsoft Internet Explorer 6 Service Pack 1 Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CAN-2003-1027. CAN-2003-0823 ACCEPTED 1 Microsoft Windows 2000 Microsoft FrontPage Server Extensions 2000 Tiffany Bergeron Andrew Buttner INTERIM ACCEPTED Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions 2000 and 2002 allows remote attackers to execute arbitrary code via a certain chunked encoded request. CAN-2003-0822 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Data Access Compnents 2.7 Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. CVE-2003-0903 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft SharePoint Team Services Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. CAN-2003-0824 INTERIM 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Review whether anonymous HTTP access is allowed 2.1.2 ACCEPTED 1 Corresponds to item 2.1.2 in the Exchange 2003 Benchmark Microsoft Windows Server 2003 Microsoft Color Management Module Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1219 DRAFT 0 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. CAN-2005-1211 INTERIM 0 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Data Access Compnents 2.8 Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. CVE-2003-0903 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. CVE-2002-0648 INTERIM 0 Microsoft Windows 2000 Client Server Runtime System (CSRSS) Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED The Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0551 ACCEPTED 1 Microsoft Windows 2000 Local Security Authority Subsystem Service (LSASS) Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 2 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger CAN-2003-0112 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. CAN-2005-1211 INTERIM 0 Microsoft Windows 2000 Services for UNIX Jonathan Baker DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1205 INTERIM 0 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." CAN-2005-0554 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Windows Script Engine for JScript v5.1 Tiffany Bergeron David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. CAN-2003-0010 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Windows Script Engine for JScript v5.5 Tiffany Bergeron David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. CAN-2003-0010 ACCEPTED 2 Microsoft Windows NT Microsoft ASN.1 Library Andrew Buttner INTERIM ACCEPTED Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. CAN-2003-0818 ACCEPTED 1 Microsoft Windows XP Microsoft ASN.1 Library Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. CAN-2003-0818 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft ASN.1 Library Andrew Buttner INTERIM ACCEPTED Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. CAN-2003-0818 ACCEPTED 1 Microsoft Windows NT Windows Internet Naming Service (WINS) Andrew Buttner INTERIM ACCEPTED The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. CVE-2003-0825 ACCEPTED 1 Microsoft Windows NT Windows Internet Naming Service (WINS) Andrew Buttner INTERIM ACCEPTED The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. CVE-2003-0825 ACCEPTED 1 Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) Andrew Buttner INTERIM ACCEPTED The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. CVE-2003-0825 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." CAN-2003-1026 ACCEPTED 2 Microsoft Windows 2000 Windows Media Services Tiffany Bergeron INTERIM Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets. CVE-2003-0905 INTERIM 0 Microsoft Windows 95 Microsoft Outlook Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs CVE-2004-0121 ACCEPTED 2 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 MSN Messenger Christine Walzer INTERIM Andrew Buttner ACCEPTED Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files. CVE-2004-0122 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Outlook Express Andrew Buttner INTERIM ACCEPTED The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." CAN-2004-0380 ACCEPTED 1 Microsoft Windows 2000 Local Security Authority Subsystem Service (LSASS) Tiffany Bergeron INTERIM ACCEPTED Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. CAN-2003-0533 ACCEPTED 1 Microsoft Windows Server 2003 Secure Sockets Layer (SSL) David Proulx INTERIM ACCEPTED The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. CAN-2004-0120 ACCEPTED 1 Microsoft Windows XP Secure Sockets Layer (SSL) David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. CAN-2004-0120 ACCEPTED 2 Microsoft Windows XP Private Communications Transport (PCT) Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. CAN-2003-0719 ACCEPTED 2 Microsoft Windows 2000 Local Descriptor Table (LDT) Jonathan Baker INTERIM ACCEPTED The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory. CAN-2003-0910 ACCEPTED 1 Microsoft Windows 2000 Secure Sockets Layer (SSL) David Proulx INTERIM ACCEPTED The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. CAN-2004-0120 ACCEPTED 1 Microsoft Windows 2000 Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CAN-2003-0352 (Blaster/Nachi), CAN-2003-0715, and CAN-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. CAN-2003-0813 ACCEPTED 1 Microsoft Windows Server 2003 Remote Procedure Call (RPC) Christine Walzer A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CAN-2003-0352 (Blaster/Nachi), CAN-2003-0715, and CAN-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. CAN-2003-0813 DRAFT 0 Microsoft Windows NT Windows logon process (winlogon) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. CAN-2003-0806 ACCEPTED 1 Microsoft Windows 2000 Windows logon process (winlogon) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. CAN-2003-0806 ACCEPTED 1 Microsoft Windows NT Enhanced Metafile (EMF) Windows Metafile (WMF) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1allows remote attackers to execute arbitrary code via a malformed WNF or EMF image. CAN-2003-0906 ACCEPTED 1 Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. CAN-2003-0533 ACCEPTED 2 Microsoft Windows XP Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CAN-2003-0352 (Blaster/Nachi), CAN-2003-0715, and CAN-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. CAN-2003-0813 ACCEPTED 1 Microsoft Windows Server 2003 COM Internet Services Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." CAN-2005-0047 ACCEPTED 1 Microsoft Windows NT Private Communications Transport (PCT) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. CAN-2003-0719 ACCEPTED 1 Microsoft Windows Server 2003 Help and Support Center (HSC) Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe. CAN-2003-0907 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Agent Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. CAN-2005-1214 INTERIM 0 Microsoft Windows 2000 H.323 Jonathan Baker INTERIM ACCEPTED Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. CAN-2004-0117 ACCEPTED 1 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability. CVE-2001-0507 ACCEPTED 1 Microsoft Windows NT Local Descriptor Table (LDT) Jonathan Baker INTERIM ACCEPTED The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory. CAN-2003-0910 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability CVE-2001-0507 ACCEPTED 2 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. CVE-1999-0278 ACCEPTED 1 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. CVE-1999-0874 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED IIS HTTP service uses Integrated Windows authentication. 2.1.4 ACCEPTED 1 Corresponds to item 2.1.4 in the Exchange 2003 Benchmark Microsoft Windows Server 2003 Local Security Authority Subsystem Service (LSASS) Andrew Buttner INTERIM ACCEPTED Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. CAN-2003-0533 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5, Internet Explorer 5.5 Service Pack 1 Tiffany Bergeron INTERIM ACCEPTED Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone, then use compiled HTML help (.chm) files to execute arbitrary programs. CVE-2001-0002 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability." CVE-2001-0727 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page. CAN-2003-0344 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability. CVE-2002-0190 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft ASN.1 Library David Proulx INTERIM ACCEPTED Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2004-0123 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated. CVE-2002-0022 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer 5.5 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields. CAN-2003-0113 ACCEPTED 2 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability. CVE-2000-0778 ACCEPTED 1 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." CAN-2002-0869 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." CAN-2002-0869 ACCEPTED 2 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability." CVE-2002-1180 ACCEPTED 2 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. CAN-1999-0736 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled. CAN-2003-0226 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Review block-list Exception list entries 1.2.3 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request. CAN-2003-0227 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll. CAN-2003-0349 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors CAN-2002-1181 ACCEPTED 2 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors. CAN-2002-1181 ACCEPTED 1 Microsoft Windows Server 2003 H.323 Jonathan Baker INTERIM ACCEPTED Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. CAN-2004-0117 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// or other requests that point to the program and open multiple file download dialogs, which eventually cause Internet Explorer to execute the program, as demonstrated using a large number of FRAME or IFRAME tags, aka the "File Download Dialog Vulnerability." CAN-2003-0309 ACCEPTED 2 Microsoft Windows 2000 Private Communications Transport (PCT) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. CAN-2003-0719 ACCEPTED 1 Microsoft Windows NT SNMP Christine Walzer INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries. CVE-1999-0815 ACCEPTED 2 Microsoft Windows 2000 Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. CAN-2004-0116 ACCEPTED 1 Microsoft Windows NT HTML Help Facility Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CAN-2004-0475. CAN-2003-1041 ACCEPTED 1 Microsoft Windows Server 2003 Remote Procedure Call (RPC) Christine Walzer An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. CAN-2004-0116 DRAFT 0 Microsoft Windows XP Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. CAN-2004-0116 ACCEPTED 2 Microsoft Windows 2000 Enhanced Metafile (EMF) Windows Metafile (WMF) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1allows remote attackers to execute arbitrary code via a malformed WNF or EMF image. CAN-2003-0906 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.5 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. CAN-2003-0353 ACCEPTED 2 Microsoft Windows XP Microsoft Data Access Components 2.6 Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. CAN-2003-0353 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer 5.5 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files. CAN-2003-0114 ACCEPTED 2 Microsoft Windows XP H.323 Jonathan Baker INTERIM ACCEPTED Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. CAN-2004-0117 ACCEPTED 1 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request. CAN-2003-0227 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Jet Database Engine Andrew Buttner INTERIM ACCEPTED Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query. CAN-2004-0197 ACCEPTED 1 Microsoft Windows NT COM Internet Services Christine Walzer INTERIM ACCEPTED Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a specially crafted request. CAN-2003-0807 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874. CVE-2002-0027 ACCEPTED 2 Microsoft Windows XP IIS 5.1 Christine Walzer INTERIM ACCEPTED Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." CAN-2002-0869 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express Andrew Buttner INTERIM ACCEPTED The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." CAN-2004-0380 ACCEPTED 1 Microsoft Windows 2000 COM Internet Services Christine Walzer INTERIM ACCEPTED Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a specially crafted request. CAN-2003-0807 ACCEPTED 1 Microsoft Windows 98 File and Print Sharing Tiffany Bergeron INTERIM ACCEPTED File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability. CVE-2000-0979 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Review blocked sender list 1.2.8 ACCEPTED 1 Corresponds to item 1.2.8 in the Exchange 2003 Benchmark Microsoft Windows XP Help and Support Center (HSC) Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe. CAN-2003-0907 ACCEPTED 2 Microsoft Windows XP Windows XP Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability." CAN-2003-0909 ACCEPTED 2 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." CAN-2005-0055 ACCEPTED 1 Microsoft Windows XP Microsoft ASN.1 Library David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2004-0123 ACCEPTED 2 Microsoft Windows XP Help and Support Center (HSC) Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm). CAN-2004-0199 ACCEPTED 2 Microsoft Windows XP IIS 5.1 Christine Walzer INTERIM ACCEPTED IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned. CVE-2002-1182 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express Andrew Buttner INTERIM ACCEPTED The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." CAN-2004-0380 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned CVE-2002-1182 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download. CVE-2001-0875 ACCEPTED 2 Microsoft Windows 2000 Lightweight Directory Access Protocol (LDAP) Tiffany Bergeron INTERIM ACCEPTED Unknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a crafted LDAP message. CAN-2003-0663 ACCEPTED 1 Microsoft Windows NT IIS 4.0 Christine Walzer INTERIM ACCEPTED Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. CVE-2001-0333 ACCEPTED 1 Microsoft Windows NT Tiffany Bergeron INTERIM ACCEPTED The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability. CVE-2000-0377 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange 2000 Tiffany Bergeron INTERIM ACCEPTED Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys. CVE-2002-0049 ACCEPTED 1 Microsoft Windows NT Tiffany Bergeron INTERIM ACCEPTED The registry in Windows NT can be accessed remotely by users who are not administrators. CAN-1999-0562 ACCEPTED 1 Microsoft Windows 2000 NetBIOS Tiffany Bergeron INTERIM ACCEPTED A component service related to NETBIOS is running. CAN-1999-0621 ACCEPTED 1 Microsoft Windows NT SQL Server 2000 Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key." CVE-2002-0642 ACCEPTED 3 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. CVE-2002-0648 INTERIM 0 Microsoft Windows 2000 Microsoft DirectPlay Tiffany Bergeron INTERIM ACCEPTED IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. CAN-2004-0202 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Outlook Express Andrew Buttner INTERIM ACCEPTED The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." CAN-2004-0380 ACCEPTED 1 Microsoft Windows Server 2003 COM Internet Services Christine Walzer INTERIM ACCEPTED Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a specially crafted request. CAN-2003-0807 ACCEPTED 1 Microsoft Windows Server 2003 Help and Support Center (HSC) Harvey Rubinovitz INTERIM ACCEPTED Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm). CAN-2004-0199 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Veritas Backup Exec 8.5 Tiffany Bergeron INTERIM Ingrid Skoog Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which enables anonymous listing of the SAM database and shares. CVE-2002-1117 INTERIM 0 Microsoft Windows XP Microsoft Data Access Components 2.7 Christine Walzer Christine Walzer INTERIM ACCEPTED Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. CAN-2003-0353 ACCEPTED 3 Microsoft Windows NT Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." CAN-2004-0124 ACCEPTED 1 Microsoft Windows 2000 Utility Manager Harvey Rubinovitz INTERIM ACCEPTED The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CAN-2004-0213. CAN-2003-0908 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. CVE-2001-0333 ACCEPTED 1 Microsoft Windows XP Compressed Folders David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation CAN-2004-0575 ACCEPTED 3 Microsoft Windows XP Windows logon process (winlogon) Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. CAN-2003-0806 ACCEPTED 2 Microsoft Windows XP CertGetCertificateChain, CertVerifyCertificateChainPolicy, and WinVerifyTrust APIs Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. CAN-2002-0862 ACCEPTED 2 Microsoft Windows XP HTML Help Facility Andrew Buttner DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1208 INTERIM 0 Microsoft Windows NT Certificate Validation Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). CVE-2002-1183 ACCEPTED 2 Microsoft Windows 2000 Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." CAN-2004-0124 ACCEPTED 1 Microsoft Windows XP Enhanced Metafile (EMF) Windows Metafile (WMF) Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1allows remote attackers to execute arbitrary code via a malformed WNF or EMF image. CAN-2003-0906 ACCEPTED 2 Microsoft Windows Server 2003 Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." CAN-2004-0124 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Christine Walzer INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0 CVE-2001-0241 ACCEPTED 2 Microsoft Windows XP Remote Procedure Call (RPC) Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." CAN-2004-0124 ACCEPTED 2 Microsoft Windows NT Microsoft Windows 2000 Microsoft ASN.1 Library David Proulx INTERIM ACCEPTED Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2004-0123 ACCEPTED 1 Microsoft Windows NT SQL Server 2000 Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Multiple buffer overflows in SQL Server 2000 Resolution Service allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption CAN-2002-0649 ACCEPTED 3 Microsoft Windows 2000 NetBIOS Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Interactions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram CAN-2000-1079 ACCEPTED 2 Microsoft Windows Server 2003 Private Communications Transport (PCT) Andrew Buttner INTERIM ACCEPTED Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. CAN-2003-0719 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer 5.5 Service Pack 2 Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Heap-based buffer overflow in plugin.ocx for Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via the Load() method, a different vulnerability than CAN-2003-0115. CAN-2003-0233 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5, Internet Explorer 5.5 Service Pack 1 Tiffany Bergeron INTERIM ACCEPTED Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability." CVE-2001-0339 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 GDI+ Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 1 Microsoft Windows Server 2003 Internet Explorer 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. CAN-2004-1319 ACCEPTED 2 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. CAN-2005-1211 INTERIM 0 Microsoft Windows 2000 Remote Procedure Call (RPC) Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function CAN-2003-0605 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Color Management Module Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1219 DRAFT 0 Microsoft Windows XP Services for UNIX Jonathan Baker DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1205 INTERIM 0 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Tiffany Bergeron DRAFT INTERIM ACCEPTED The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifiying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. CAN-2004-0549 ACCEPTED 1 Microsoft Windows XP SMB (Server Message Block) Jonathan Baker DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1206 INTERIM 0 Microsoft Windows 2000 ISA Server 2000 Christine Walzer DRAFT INTERIM Microsoft ISA Server 2000 allows remote attackers to poison the ISA cache or bypass content restriction policies via a malformed HTTP request packet containing multiple Content-Length headers. CAN-2005-1215 INTERIM 0 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. CVE-2002-0648 INTERIM 0 Microsoft Windows 2000 Crystal Enterprise Crystal Reports Andrew Buttner Jonathan Baker Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx CAN-2004-0204 DRAFT 0 Microsoft Windows 2000 COM Internet Services Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." CAN-2005-0047 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED 'Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka \"Table Conversion Vulnerability,\" a different vulnerability than CAN-2004-0901' CAN-2004-0571 ACCEPTED 2 Microsoft Windows XP Windows Media Player 9 Christine Walzer DRAFT INTERIM ACCEPTED The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." CAN-2005-0044 ACCEPTED 1 Microsoft Windows XP HTML Help Facility Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CAN-2004-0475. CAN-2003-1041 ACCEPTED 1 Microsoft Windows XP Microsoft Office XP SP3 Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0564 DRAFT 0 Microsoft Windows XP Microsoft Agent Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. CAN-2005-1214 INTERIM 0 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." CAN-2005-0554 ACCEPTED 1 Microsoft Windows Server 2003 Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0528 CAN-2003-0715 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. CVE-2002-0648 INTERIM 0 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1211 INTERIM 0 Microsoft Windows 2000 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 2 Microsoft Windows XP Web Client Service Matthew Burton DRAFT Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. CAN-2005-1207 DRAFT 0 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 2 Microsoft Windows Server 2003 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". CAN-2005-0550 ACCEPTED 1 Microsoft Windows 98 Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows 2000 Microsoft Color Management Module Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-1219 DRAFT 0 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016). CAN-2005-0688 ACCEPTED 1 Microsoft Windows 98 Internet Explorer 6 Internet Explorer 6 SP1 Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED 'Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utilit' CAN-2004-1050 ACCEPTED 2 Microsoft Windows XP Windows Animated Cursor Christine Walzer DRAFT INTERIM ACCEPTED The Windows Animated Cursor (ANI) in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to cause a denial of service (kernel crash or resource consumption) via the (1) frame number or (2) rate number set to zero CAN-2004-1305 ACCEPTED 1 Microsoft Windows XP Windows Media Player 9 Christine Walzer DRAFT Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." CAN-2004-1244 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." CAN-2005-0054 ACCEPTED 1 Microsoft Windows NT Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 1 Microsoft Windows 2000 IIS 5.0 Jonathan Baker DRAFT INTERIM ACCEPTED The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. CAN-2003-0718 ACCEPTED 1 Microsoft Windows 2000 Microsoft Office 2000 SP3 Christine Walzer DRAFT ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0564 DRAFT 0 Microsoft Windows 2000 Certificate Validation Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. CAN-2002-0862 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Internet Explorer 6.0 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows NT Internet Explorer 6 Tiffany Bergeron INTERIM ACCEPTED Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. CAN-2004-0212 ACCEPTED 0 Microsoft Windows Server 2003 HTML Help ActiveX Control Matthew Burton DRAFT INTERIM ACCEPTED Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." CAN-2004-1043 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disallow execute permissions to the Exchange HTTP virtual directory ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow digest or integrated windows authentication (NTLM) to connect to the Exchange HTTP virtual directories ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disallow all access to Exchange HTTP virtual directories ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should Display the routing groups in the Exchange System Manager ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should Display the administrative groups in the Exchange System Manager ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should enable forms based authentication ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow digest or integrated windows authentication (NTLM) to connect to the Public HTTP virtual directories ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disallow execute permissions to the Public HTTP virtual directory ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disallow all access to Public HTTP virtual directories ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should zero out deleted database pages ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disable all automated message generation ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the IMAP4 service ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use SSL when downloading meeting requests ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use the default TCP ports for the the IMAP4 services ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should archive all messages received by mailboxes on this store ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should have clients support S/MIME ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should not delete mailboxes without waiting for the store to be backed up ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should subscribe to a block list to block spam ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should limit the size of messages to and from the server to 30MB ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should limit the number of recipients in outbound messages to 5000 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disable the filtering of recipients who are not in Active Directory ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Charles Schmidt INTERIM ACCEPTED Microsoft Exchange Server 2003 should archive filtered messages 1.2.9 ACCEPTED 2 Corresponds to item 1.2.9 in the Exchange 2003 Benchmark Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should filter messages with a blank sender ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should drop connections if the address matches filters ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should accept messages without notifying the sender of filtering ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disable Outlook Mobile Access ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disable ActiveSync ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the POP3 service ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use SSL when downloading meeting requests ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use TCP ports 143 and 995 for the POP3 service ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should have mailbox store clients support S/MIME signatures ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should enable subject logging and display ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should enable message tracking ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disable automatic log removal ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should not disable all monitoring on this server ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should change state to critical when any service stops ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should limit any connector scope to the routing group ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should disallow unauthenticated entities to relay through this SMTP connector ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should force outbound connections to use basic authentication with TLS encryption ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should have any SMTP connectors use a smart host ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the SMTP server ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should not resolve anonymous email ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should only allow explicitly listed hosts to relay messages through this sever ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use a smart host to relay SMTP messages ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should not perform reverse DNS lookups on incoming messages ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use port 25 for outbound SMTP connections ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use only basic authentication with TLS encryption for outbound SMTP connections ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should enable logging of connections between SMTP hosts ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should use port 25 for inbound SMTP connections ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Charles Schmidt DRAFT INTERIM ACCEPTED Microsoft Exchange Server 2003 should apply sender, recipient, and connection filters ACCEPTED 1 Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 1 Microsoft Windows XP IIS 5.1 Jonathan Baker DRAFT INTERIM ACCEPTED The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. CAN-2003-0718 ACCEPTED 1 Microsoft Windows NT Certificate Validation Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). CVE-2002-1183 ACCEPTED 1 Microsoft Windows 2000 HTML Help Facility Andrew Buttner INTERIM ACCEPTED Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CAN-2003-1041. CAN-2004-0201 ACCEPTED 0 Microsoft Windows NT VDM Ingrid Skoog Ingrid Skoog ACCEPTED The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code. CAN-2004-0118 ACCEPTED 2 Microsoft Windows XP HTML Help Facility Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CAN-2003-1041. CAN-2004-0201 ACCEPTED 1 Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) Matthew Burton DRAFT INTERIM ACCEPTED 'The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42' CAN-2004-1080 ACCEPTED 1 Microsoft Windows 2000 Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 2 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". CAN-2004-0839 ACCEPTED 1 Microsoft Windows Server 2003 Windows Media Player 9 Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." CAN-2004-1244 ACCEPTED 1 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 1 Microsoft Windows ME Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. CAN-2004-0214 ACCEPTED 1 Microsoft Windows XP HyperTerminal Harvey Rubinovitz DRAFT Harvey Rubinovitz Harvey Rubinovitz INTERIM Christine Walzer David Proulx ACCEPTED 'HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.' CVE-2004-0568 ACCEPTED 1 Microsoft Windows XP SMB (Server Message Block) Christine Walzer DRAFT INTERIM ACCEPTED The Server Message Block (SMB) implementation for Windows 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code using certain broadcast packets, aka the "Server Message Block Vulnerability." CAN-2005-0045 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. CAN-2005-0061 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". CAN-2005-0553 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The DHTML Edit Control (dhtmled.ocx) in Internet Explorer 6.0.2900.2180 allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent." CAN-2004-1319 ACCEPTED 2 Microsoft Windows NT VDM Ingrid Skoog ACCEPTED The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code. CAN-2004-0118 ACCEPTED 2 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visual Studio .NET 2003 Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." CAN-2005-0054 ACCEPTED 1 Microsoft Windows NT Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. CAN-2004-0214 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 VDM Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. CAN-2004-0208 ACCEPTED 1 Microsoft Windows Server 2003 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. CAN-2005-0061 ACCEPTED 1 Microsoft Windows XP Task Scheduler Tiffany Bergeron INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. CAN-2004-0212 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows 2000 Negotiate SSP interface Ingrid Skoog INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection CAN-2004-0119 ACCEPTED 2 Microsoft Windows XP Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0528 CAN-2003-0715 ACCEPTED 1 Microsoft Windows Server 2003 Client Server Runtime System (CSRSS) Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0551 ACCEPTED 1 Microsoft Windows XP Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows XP Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows Server 2003 SMB (Server Message Block) Christine Walzer DRAFT INTERIM ACCEPTED The Server Message Block (SMB) implementation for Windows 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code using certain broadcast packets, aka the "Server Message Block Vulnerability." CAN-2005-0045 ACCEPTED 1 Microsoft Windows NT NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows XP Enhanced Metafile (EMF) Ingrid Skoog DRAFT INTERIM ACCEPTED Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." CAN-2004-0209 ACCEPTED 1 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 2 Microsoft Windows Server 2003 Local Security Authority Subsystem Service (LSASS) Christine Walzer DRAFT INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 1 Microsoft Windows XP SMB (Server Message Block) Christine Walzer DRAFT INTERIM ACCEPTED The Server Message Block (SMB) implementation for Windows 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code using certain broadcast packets, aka the "Server Message Block Vulnerability." CAN-2005-0045 ACCEPTED 1 Microsoft Windows 2000 HTML Help Facility Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CAN-2004-0475. CAN-2003-1041 ACCEPTED 0 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express Jonathan Baker DRAFT INTERIM ACCEPTED Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. CAN-2004-0215 ACCEPTED 1 Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 2 Microsoft Windows Server 2003 Negotiate Security Software Provider Ingrid Skoog INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. CAN-2004-0119 ACCEPTED 2 Microsoft Windows XP Windows XP Matthew Burton DRAFT INTERIM ACCEPTED Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." CAN-2004-1043 ACCEPTED 1 Microsoft Windows XP Task Scheduler Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. CAN-2004-0212 ACCEPTED 0 Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 1 Microsoft Windows XP Negotiate SSP interface Ingrid Skoog Ingrid Skoog Ingrid Skoog ACCEPTED Christine Walzer INTERIM ACCEPTED The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. CAN-2004-0119 ACCEPTED 1 Microsoft Windows XP Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 2 Microsoft Windows NT Outlook Web Access Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query. CAN-2004-0203 ACCEPTED 2 Microsoft Windows NT Windows kernel Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". CAN-2005-0550 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Christine Walzer DRAFT INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". CAN-2004-0839 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." CAN-2005-0555 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer 5.5 Service Pack 2 Andrew Buttner DRAFT INTERIM ACCEPTED Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. CAN-2003-1048 ACCEPTED 1 Microsoft Windows NT Certificate Validation Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). CVE-2002-1183 ACCEPTED 1 Microsoft Windows 2000 Enhanced Metafile (EMF) Ingrid Skoog DRAFT INTERIM ACCEPTED Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." CAN-2004-0209 ACCEPTED 1 Microsoft Windows Server 2003 Indexing Service Harvey Rubinovitz DRAFT INTERIM ACCEPTED The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2004-0897 ACCEPTED 1 Microsoft Windows 2000 Microsoft Outlook Express Jonathan Baker DRAFT INTERIM ACCEPTED Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. CAN-2004-0215 ACCEPTED 1 Microsoft Windows Server 2003 HTML Help Facility Andrew Buttner INTERIM ACCEPTED Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CAN-2003-1041. CAN-2004-0201 ACCEPTED 0 Microsoft Windows NT POSIX Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow. CAN-2004-0210 ACCEPTED 0 Microsoft Windows XP Windows Shell Harvey Rubinovitz DRAFT INTERIM ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CAN-2004-0790, CAN-2004-0791, and CAN-2004-1060 have been SPLIT based on different attacks; CAN-2005-0065, CAN-2005-0066, CAN-2005-0067, and CAN-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. CAN-2004-1060 ACCEPTED 1 Microsoft Windows XP DirectX Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. CAN-2004-0202 ACCEPTED 1 Microsoft Windows NT IIS 4.0 David Proulx INTERIM ACCEPTED Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function. CAN-2004-0205 ACCEPTED 0 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. CAN-2004-0845 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." CAN-2005-0554 ACCEPTED 1 Microsoft Windows NT Windows kernel Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 1 Microsoft Windows 2000 MDAC 2.8 Christine Walzer DRAFT INTERIM ACCEPTED Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. CAN-2004-0597 ACCEPTED 1 Microsoft Windows NT DHCP Ingrid Skoog DRAFT Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability. CAN-2004-0899 ACCEPTED 1 Microsoft Windows XP Jonathan Baker DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0051 ACCEPTED 2 Microsoft Windows Server 2003 SMTP Christine Walzer DRAFT Christine Walzer INTERIM ACCEPTED The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. CAN-2004-0840 ACCEPTED 1 Microsoft Windows XP Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. CAN-2003-0352 ACCEPTED 1 This bulletin has been superceded by MS03-039. Definition reflects updated information. Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2002 Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. CAN-2004-0848 ACCEPTED 1 Microsoft Windows XP COM Internet Services Christine Walzer DRAFT INTERIM ACCEPTED Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." CAN-2005-0047 ACCEPTED 1 Microsoft Windows 2000 Windows Media Player 9 Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." CAN-2004-1244 ACCEPTED 1 Microsoft Windows Server 2003 Internet Explorer 6 Christine Walzer INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 0 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." CAN-2005-0056 ACCEPTED 1 Microsoft Windows NT NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows XP DirectX Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. CAN-2004-0202 ACCEPTED 2 Microsoft Windows XP Microsoft Windows Server 2003 Enhanced Metafile (EMF) Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." CAN-2004-0209 ACCEPTED 1 Microsoft Windows XP Indexing Service Harvey Rubinovitz DRAFT INTERIM ACCEPTED The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. CAN-2004-0897 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability." CAN-2004-0844 ACCEPTED 2 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 1 Microsoft Windows 2000 Utility Manager Jonathan Baker INTERIM ACCEPTED Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CAN-2003-0908. CAN-2004-0213 ACCEPTED 0 Microsoft Windows NT Remote Procedure Call (RPC) Matthew Burton DRAFT INTERIM ACCEPTED The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values. CAN-2004-0569 ACCEPTED 1 Microsoft Windows Server 2003 DirectX Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. CAN-2004-0202 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42 CAN-2004-1080 ACCEPTED 1 Microsoft Windows XP HyperTerminal Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer David Proulx INTERIM ACCEPTED HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. CVE-2004-0568 ACCEPTED 2 Microsoft Windows Server 2003 Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." CAN-2005-0554 ACCEPTED 1 Microsoft Windows 2000 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0060 ACCEPTED 1 Microsoft Windows 2000 MDAC 2.8 Ingrid Skoog DRAFT INTERIM ACCEPTED The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." CAN-2005-0050 ACCEPTED 1 Microsoft Windows XP Hyperlink Object Library Andrew Buttner DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0057 ACCEPTED 1 Microsoft Windows Server 2003 Windows Animated Cursor Christine Walzer DRAFT INTERIM ACCEPTED The Windows Animated Cursor (ANI) in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to cause a denial of service (kernel crash or resource consumption) via the (1) frame number or (2) rate number set to zero CAN-2004-1305 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 1 Microsoft Windows 98 Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. CAN-2004-0214 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Outlook Express Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. CAN-2004-0215 ACCEPTED 2 Microsoft Windows 2000 Microsoft Office 2000 SP3 Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. CAN-2004-0573 ACCEPTED 2 Microsoft Windows 2000 Certificate Validation Christine Walzer Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. CAN-2002-0862 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2000 Matthew Burton DRAFT INTERIM ACCEPTED Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated. CAN-2004-0846 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." CAN-2005-0055 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 DirectX Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. CAN-2004-0202 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Office 2003 Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.5 Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. CVE-2002-1142 ACCEPTED 2 Microsoft Windows Server 2003 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0060 ACCEPTED 1 Microsoft Windows NT Windows Internet Naming Service (WINS) Matthew Burton DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42 CAN-2004-1080 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2002 Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a long URL file location. CAN-2004-0848 ACCEPTED 1 Microsoft Windows 2000 Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0555 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6.0 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." CAN-2005-0056 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT Matthew Burton Matthew Burton INTERIM ACCEPTED Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." CAN-2004-1043 ACCEPTED 1 Microsoft Windows 2000 POSIX Ingrid Skoog INTERIM ACCEPTED The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow. CAN-2004-0210 ACCEPTED 0 Microsoft Windows XP Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0715 CAN-2003-0528 ACCEPTED 1 Microsoft Windows XP COM Internet Services Christine Walzer DRAFT INTERIM ACCEPTED Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." CAN-2005-0047 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Christine Walzer INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 0 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." CAN-2004-0842 ACCEPTED 1 Microsoft Windows 2000 Windows Media Player 9 Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." CAN-2005-0044 ACCEPTED 2 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Adobe Acrobat Reader Matthew Wojcik DRAFT INTERIM ACCEPTED Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields. CAN-2004-1153 ACCEPTED 1 iDEFENSE reports that deleting eBook.api from the plug_ins directory is a workaround. See http://www.idefense.com/application/poi/display?id=163&type=vulnerabilities Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows XP Cursor and Icon Formatting Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-1049 ACCEPTED 1 Microsoft Windows XP Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0715 CAN-2003-0528 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2002 Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows XP Jonathan Baker DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0051 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." CAN-2005-0054 ACCEPTED 1 Microsoft Windows NT Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2002 Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows XP Explorer.exe Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Buffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter. CAN-2003-0306 ACCEPTED 0 Microsoft Windows NT Cursor and Icon Formatting Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-1049 ACCEPTED 1 Microsoft Windows Server 2003 Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". CAN-2005-0553 ACCEPTED 1 Microsoft Windows 2000 NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6.0 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." CAN-2005-0055 ACCEPTED 1 Microsoft Windows Server 2003 HyperTerminal Harvey Rubinovitz DRAFT Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. CVE-2004-0568 ACCEPTED 1 Microsoft Windows 2000 Windows kernel Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. CAN-2003-0112 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0555 ACCEPTED 1 Microsoft Windows XP VDM Ingrid Skoog DRAFT INTERIM ACCEPTED The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. CAN-2004-0208 ACCEPTED 1 Microsoft Windows NT HTML Help Facility Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CAN-2003-1041. CAN-2004-0201 ACCEPTED 1 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." CAN-2005-0054 ACCEPTED 1 Microsoft Windows Server 2003 Hyperlink Object Library Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0057 ACCEPTED 1 Microsoft Windows 2000 Windows Animated Cursor Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED The Windows Animated Cursor (ANI) in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to cause a denial of service (kernel crash or resource consumption) via the (1) frame number or (2) rate number set to zero CAN-2004-1305 ACCEPTED 2 Microsoft Windows Server 2003 Cursor and Icon Formatting Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-1049 ACCEPTED 1 Microsoft Windows XP NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-0901 ACCEPTED 1 Microsoft Windows XP Microsoft Office 2003 Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. CAN-2004-0573 ACCEPTED 3 Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Ingrid Skoog DRAFT INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." CAN-2005-0056 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2003 Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Christine Walzer DRAFT INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 1 Microsoft Windows XP Microsoft Office XP SP3 Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. CAN-2004-0573 ACCEPTED 2 Microsoft Windows NT Cursor and Icon Formatting Christine Walzer DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-1049 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6.1 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." CAN-2004-0842 ACCEPTED 2 Microsoft Windows XP Microsoft Outlook Express Jonathan Baker DRAFT INTERIM Christine Walzer ACCEPTED Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. CAN-2004-0215 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6 Christine Walzer DRAFT INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 1 Microsoft Windows XP SMB (Server Message Block) Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. CAN-2003-0345 ACCEPTED 0 Microsoft Windows 2000 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka CAN-2004-0571 ACCEPTED 2 Microsoft Windows 2000 Task Scheduler Tiffany Bergeron INTERIM ACCEPTED Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. CAN-2004-0212 ACCEPTED 0 Microsoft Windows XP Windows Shell Harvey Rubinovitz DRAFT INTERIM ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CAN-2004-0790, CAN-2004-0791, and CAN-2004-1060 have been SPLIT based on different attacks; CAN-2005-0065, CAN-2005-0066, CAN-2005-0067, and CAN-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. CAN-2004-0790 ACCEPTED 1 Microsoft Windows Server 2003 SMTP Christine Walzer DRAFT INTERIM ACCEPTED The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. CAN-2004-0840 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The DHTML Edit Control (dhtmled.ocx) in Internet Explorer 6.0.2900.2180 allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent." CAN-2004-1319 ACCEPTED 2 Microsoft Windows XP NetBT Name Service Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED The NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0, 2000, XP, and Server 2003 may include random memory in a response to a NBNS query, which could allow remote attackers to obtain sensitive information. CAN-2003-0661 ACCEPTED 0 Microsoft Windows NT HTML Help ActiveX Control Matthew Burton DRAFT INTERIM ACCEPTED Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." CAN-2004-1043 ACCEPTED 1 Microsoft Windows Server 2003 HTML Help Facility Andrew Buttner INTERIM ACCEPTED Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CAN-2004-0475. CAN-2003-1041 ACCEPTED 0 Microsoft Windows XP Internet Explorer 6 Christine Walzer INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 0 Microsoft Windows XP Client Server Runtime System (CSRSS) Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0551 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 MDAC 2.7 Matthew Burton DRAFT INTERIM ACCEPTED The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability." CAN-2004-0847 ACCEPTED 1 Microsoft Windows Server 2003 OLE Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." CAN-2005-0044 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows NT MDAC 2.1 Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. CVE-2002-1142 ACCEPTED 2 Microsoft Windows NT DHCP Ingrid Skoog DRAFT INTERIM ACCEPTED The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability." CAN-2004-0900 ACCEPTED 1 Microsoft Windows Server 2003 MDAC 2.8 Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." CAN-2005-0050 ACCEPTED 2 Microsoft Windows 2000 Windows Explorer Ingrid Skoog DRAFT Andrew Buttner INTERIM The Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file. CAN-2005-1191 INTERIM 0 Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." CAN-2005-0054 ACCEPTED 1 Microsoft Windows NT Internet Explorer 6 Christine Walzer DRAFT INTERIM ACCEPTED The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. CAN-2004-0420 ACCEPTED 1 Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) Matthew Burton DRAFT INTERIM ACCEPTED The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42 CAN-2004-1080 ACCEPTED 1 Microsoft Windows XP Help and Support Center (HSC) Christine Walzer DRAFT INTERIM ACCEPTED Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL CAN-2003-0711 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". CAN-2005-0553 ACCEPTED 1 Microsoft Windows ME Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows ME Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html" CAN-2004-0839 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2003 Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." CAN-2005-0554 ACCEPTED 1 Microsoft Windows XP Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability." CAN-2005-0048 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM Andrew Buttner ACCEPTED The DHTML Edit Control (dhtmled.ocx) in Internet Explorer 6.0.2900.2180 allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent." CAN-2004-1319 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. CAN-2004-0845 ACCEPTED 2 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Office XP SP2 Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 2 Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 1 Microsoft Windows XP Windows Help and Support Center Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL CAN-2003-0711 ACCEPTED 2 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." CAN-2005-0055 ACCEPTED 1 Microsoft Windows Server 2003 Compressed Folders David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation CAN-2004-0575 ACCEPTED 3 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer 6 Service Pack 1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0555 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0060 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 1 Microsoft Windows NT VDM Ingrid Skoog DRAFT INTERIM ACCEPTED The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. CAN-2004-0208 ACCEPTED 1 Microsoft Windows NT Windows Animated Cursor Christine Walzer DRAFT INTERIM ACCEPTED The Windows Animated Cursor (ANI) in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to cause a denial of service (kernel crash or resource consumption) via the (1) frame number or (2) rate number set to zero CAN-2004-1305 ACCEPTED 1 Microsoft Windows Server 2003 Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0715 CAN-2003-0528 ACCEPTED 1 Microsoft Windows NT HyperTerminal Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. CVE-2004-0568 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. CAN-2005-0061 ACCEPTED 1 Microsoft Windows XP GDI+ Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 1 Microsoft Windows XP Microsoft Office XP SP2 Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. CAN-2004-0573 ACCEPTED 2 Microsoft Windows NT Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office XP SP3 Ingrid Skoog Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. CAN-2004-0848 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server 2003 Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the SMTP service of Exchange Server 2000 and 2003 allows remote attackers to execute arbitrary code via a crafted extended verb request to the SMTP port. CAN-2005-0560 ACCEPTED 1 Microsoft Windows 2000 SMB (Server Message Block) Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED The Server Message Block (SMB) implementation for Windows 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code using certain broadcast packets, aka the "Server Message Block Vulnerability." CAN-2005-0045 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 2 Microsoft Windows XP Microsoft Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." CAN-2005-0056 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". CAN-2004-0839 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.1 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "&lt;STYLE&gt;@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." CAN-2004-0842 ACCEPTED 1 Microsoft Windows 2000 Internet Explorer 6 SP1 Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 1 Microsoft Windows XP Distributed Component Object Model (DCOM) interface Christine Walzer DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CAN-2003-0352 (Blaster/Nachi) and CAN-2003-0528 CAN-2003-0715 ACCEPTED 1 Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2002 Matthew Burton DRAFT Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated. CAN-2004-0846 DRAFT 0 Microsoft Windows Server 2003 Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows 2000 ISA Server 2000 Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup resul CAN-2004-0892 ACCEPTED 1 Microsoft Windows Server 2003 Compressed Folders David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation CAN-2004-0575 ACCEPTED 3 Microsoft Windows NT DHCP Ingrid Skoog DRAFT INTERIM ACCEPTED The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability." CAN-2004-0899 ACCEPTED 1 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visual Studio .NET 2002 Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. CAN-2004-0200 ACCEPTED 1 Microsoft Windows 2000 VDM Ingrid Skoog DRAFT INTERIM ACCEPTED The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. CAN-2004-0208 ACCEPTED 1 Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CAN-2004-0901 CAN-2004-0571 ACCEPTED 1 Microsoft Windows 2000 Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. CAN-2004-0214 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 1 Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Christine Walzer DRAFT INTERIM ACCEPTED LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program CAN-2004-0894 ACCEPTED 1 Microsoft Windows NT Windows Internet Naming Service (WINS) Matthew Burton DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42. CAN-2004-1080 ACCEPTED 2 Microsoft Windows XP Message Queuing Ingrid Skoog DRAFT INTERIM ACCEPTED Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message. CAN-2005-0059 ACCEPTED 1 Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) Christine Walzer DRAFT INTERIM ACCEPTED The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. CAN-2004-0574 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". CAN-2005-0550 ACCEPTED 1 Microsoft Windows Server 2003 Windows kernel Christine Walzer DRAFT INTERIM ACCEPTED The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability. CAN-2004-0893 ACCEPTED 1 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Adobe Acrobat Reader Matthew Wojcik DRAFT INTERIM ACCEPTED Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. CAN-2004-0597 ACCEPTED 1 Microsoft Windows Server 2003 Program Group Converter Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. CAN-2004-0572 ACCEPTED 1 Microsoft Windows XP unknown Christine Walzer DRAFT INTERIM ACCEPTED The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." CAN-2005-0044 ACCEPTED 1 Microsoft Windows NT HyperTerminal Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. CVE-2004-0568 ACCEPTED 1 Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571. CAN-2004-0901 ACCEPTED 1 Microsoft Windows Server 2003 NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows 2000 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. CAN-2005-0061 ACCEPTED 1 Microsoft Windows 2000 Cursor and Icon Formatting Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided CAN-2004-1049 ACCEPTED 2 Microsoft Windows Server 2003 Internet Explorer 6.0 Harvey Rubinovitz DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2005-0555 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." CAN-2004-0727 ACCEPTED 1 Microsoft Windows Server 2003 Help and Support Center (HSC) Christine Walzer DRAFT INTERIM ACCEPTED Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL CAN-2003-0711 ACCEPTED 1 Microsoft Windows 2000 Windows Shell Harvey Rubinovitz DRAFT INTERIM Andrew Buttner ACCEPTED The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. CAN-2005-0063 ACCEPTED 1 Microsoft Windows Server 2003 Windows Messenger Matthew Burton DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows 2000 HyperTerminal Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. CVE-2004-0568 ACCEPTED 1 Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Christine Walzer DRAFT INTERIM ACCEPTED Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CAN-2004-0571 CAN-2004-0901 ACCEPTED 1 Microsoft Windows Server 2003 Internet Explorer 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED The DHTML Edit Control (dhtmled.ocx) in Internet Explorer 6.0.2900.2180 allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent." CAN-2004-1319 ACCEPTED 2 Microsoft Windows NT VDM Ingrid Skoog DRAFT INTERIM ACCEPTED The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. CAN-2004-0208 ACCEPTED 1 Microsoft Windows Server 2003 IIS 6.0 Jonathan Baker DRAFT INTERIM ACCEPTED The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. CAN-2003-0718 ACCEPTED 1 Microsoft Windows NT MDAC 2.8 Ingrid Skoog DRAFT INTERIM ACCEPTED The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." CAN-2005-0050 ACCEPTED 1 Microsoft Windows 2000 Windows 2000 Matthew Burton DRAFT INTERIM ACCEPTED TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. CAN-2004-0230 ACCEPTED 1 Microsoft Windows XP Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. CAN-2005-0060 ACCEPTED 1 Microsoft Windows NT Windows NT 4.0 Matthew Burton DRAFT INTERIM ACCEPTED The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42 CAN-2004-1080 ACCEPTED 1 Microsoft Windows 2000 Windows kernel Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". CAN-2005-0550 ACCEPTED 1 Microsoft Windows NT DHCP Ingrid Skoog DRAFT INTERIM ACCEPTED The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability. CAN-2004-0900 ACCEPTED 1 Microsoft Windows NT Proxy Server 2.0 SP1 Christine Walzer DRAFT INTERIM Christine Walzer Ingrid Skoog ACCEPTED Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results. CAN-2004-0892 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." CAN-2005-0053 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". CAN-2005-0553 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 Windows kernel Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service (system crash) via a malicious program. CAN-2004-0211 ACCEPTED 1 Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 MSN Messenger Christine Walzer DRAFT INTERIM ACCEPTED GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width. CAN-2005-0562 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." CAN-2005-0056 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". CAN-2005-0553 ACCEPTED 1 Microsoft Windows XP Microsoft Windows Server 2003 MDAC 2.7 Matthew Burton DRAFT INTERIM ACCEPTED The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability." CAN-2004-0847 ACCEPTED 1 Microsoft Windows 2000 Message Queuing Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message. CAN-2005-0059 ACCEPTED 1 Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) Christine Walzer DRAFT INTERIM ACCEPTED Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. CAN-2004-0573 ACCEPTED 1 Microsoft Windows NT Network News Transport Protocol (NNTP) Christine Walzer DRAFT INTERIM ACCEPTED The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. CAN-2004-0574 ACCEPTED 1 Microsoft Windows XP NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site CAN-2004-0845 ACCEPTED 1 Microsoft Windows NT Remote Procedure Call (RPC) Matthew Burton DRAFT INTERIM ACCEPTED ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CAN-2003-0569 ACCEPTED 1 Microsoft Windows XP Windows Shell Andrew Buttner DRAFT INTERIM ACCEPTED Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. CAN-2004-0214 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email. CAN-2004-0216 ACCEPTED 2 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email. CAN-2004-0216 ACCEPTED 1 Microsoft Windows Server 2003 SMTP Christine Walzer DRAFT INTERIM ACCEPTED The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. CAN-2004-0840 ACCEPTED 1 Microsoft Windows ME Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site CAN-2004-0845 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.1 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "&lt;STYLE&gt;@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." CAN-2004-0842 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 2 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. CAN-2004-0845 ACCEPTED 1 Microsoft Windows 2000 Network News Transport Protocol (NNTP) Christine Walzer DRAFT INTERIM ACCEPTED The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. CAN-2004-0574 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 1 Microsoft Windows ME Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email CAN-2004-0216 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". CAN-2004-0839 ACCEPTED 2 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 2 Microsoft Windows XP Compressed Folders David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation CAN-2004-0575 ACCEPTED 3 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.1 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "&lt;STYLE&gt;@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." CAN-2004-0842 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 4 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email. CAN-2004-0216 ACCEPTED 1 Microsoft Windows Server 2003 NetDDE Jonathan Baker DRAFT INTERIM ACCEPTED Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. CAN-2004-0206 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." CAN-2004-0727 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." CAN-2004-0727 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." CAN-2004-0843 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 5.5 Service Pack 2 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions. CAN-2003-0727 ACCEPTED 1 Microsoft Windows Server 2003 Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." CAN-2004-0727 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. CAN-2004-0845 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email. CAN-2004-0216 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". CAN-2004-0839 ACCEPTED 1 Microsoft Windows 2000 Microsoft Internet Explorer 5.01 Service Pack 3 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Buffer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email. CAN-2004-0216 ACCEPTED 1 Microsoft Windows XP Internet Explorer 6 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." CAN-2004-0727 ACCEPTED 1 Microsoft Windows ME Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." CAN-2004-0841 ACCEPTED 1 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Internet Explorer 6 SP1 Harvey Rubinovitz DRAFT INTERIM ACCEPTED Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability." CAN-2004-0844 ACCEPTED 1 This test should fail if the 64-bit (x64 architecture) version of Windows is installed. We think, but are not sure that the affected version of bkupexec.exe is 3.60.1.298 The file should be found in C:Program Files\VERITAS\Backup Exec\NT\bkupexec.exe We think, but are not sure that the affected version of bkupexec.exe is 3.60.1.298 The file should be found in C:\Program Files\VERITAS\Backup Exec\NT\bkupexec.exe Service Pack 2 or less for Windows Office XP needs regex involving strings and less than 4 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 64 ADSTYPE_INTEGER 4 ADSTYPE_INTEGER 512 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 16 ADSTYPE_INTEGER 2147483648 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 0 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 4 ADSTYPE_PRINTABLE_STRING ^https\:\/\/ ADSTYPE_INTEGER 143 ADSTYPE_INTEGER 993 ADSTYPE_DN_STRING .+ ADSTYPE_INTEGER 0 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 30720 ADSTYPE_INTEGER 30720 ADSTYPE_INTEGER 5000 ADSTYPE_INTEGER 512 ADSTYPE_PRINTABLE_STRING Filter ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 8 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 4 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 4 ADSTYPE_PRINTABLE_STRING ^https\:\/\/ ADSTYPE_INTEGER 110 ADSTYPE_INTEGER 995 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 262144 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 0 ADSTYPE_INTEGER 0 ADSTYPE_PRINTABLE_STRING ^\d+\:1\: ADSTYPE_PRINTABLE_STRING ^local\: ADSTYPE_INTEGER 4096 ADSTYPE_INTEGER 270 ADSTYPE_PRINTABLE_STRING .+ ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 131072 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 0 ADSTYPE_PRINTABLE_STRING .+ ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 25 ADSTYPE_INTEGER 268 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 25 ADSTYPE_PRINTABLE_STRING \:3$ ADSTYPE_PRINTABLE_STRING .+ Non-perjorative test .* Non-perjorative test .* Non-perjoritive test .* Non-perjoritive check .* Non-pejorative test .* ADSTYPE_INTEGER 4 ADSTYPE_INTEGER 1 ADSTYPE_INTEGER 2 ADSTYPE_INTEGER 16 ADSTYPE_INTEGER 2147483648 5 2 3790 2453 3 0 1200 257 3 0 1200 257 5 2 3644 0 5 2 3644 0 6 0 2800 1505 6 0 2800 1506 5 2 3790 88 5 1 2600 119 5 0 2195 6824 5 1 2600 1274 5 2 3790 2435 4 0 1381 7255 4 0 1381 33554 5 2 3790 99 10 00 4205 0000 4 00 02 7523 5 0 3541 2700 5 0 3828 2700 2 0 0 3423 5 2 3790 1241 5 1 2600 1683 4 00 02 7523 5 1 0 8513 5 5 0 8513 5 0 2195 6861 5 1 2600 1606 5 1 2600 2673 5 2 3790 324 5 2 3790 2437 5 2 3790 2427 10 00 5709 0000 4 0 1381 7255 4 0 1381 33559 5 0 2195 6895 5 1 2600 128 5 1 2600 1343 4 0 1381 7263 4 0 1381 33562 5 0 2195 6898 5 1 2600 132 8 00 01 9904 6 4 9 1124 8 0 0 4482 8 0 0 4482 6 4 9 1121 8 0 0 4490 5 0 2195 7044 4 0 1381 7268 4 0 1381 33591 5 0 2195 6992 5 1 2600 1331 9 0 0 8216 5 0 2195 6901 5 2 3790 132 5 1 2600 1348 5 1 2600 134 5 1 2600 1605 4 0 1381 7304 5 2 3790 134 5 1 2600 134 5 1 2600 1361 10 0 5815 0 5 2 3790 220 5 2 3790 316 4 0 1381 33587 5 0 2195 7005 4 0 1381 7329 4 0 1381 33618 5 2 3790 1673 5 2 3790 233 8 0 0 9315 4 87 1964 1880 5 1 2195 6899 5 2 3790 132 5 1 2600 136 5 1 2600 1347 5 1 2600 1609 5 1 2600 2563 2000 2 3511 0 2001 12 4414 53 2001 12 4720 130 8 0 0 9716 4 0 8618 0 4 0 8618 0 5 50 4939 300 6 00 2739 300 6 00 37909 137 6 00 2800 1409 5 0 2195 6904 5 1 2600 135 5 1 2600 1361 5 0 2195 6906 9 0 0 8216 5 131 1880 14 5 131 2195 6824 5 0 2195 6902 5 0 2195 6905 5 2 3790 139 5 1 2600 137 5 1 2600 1362 5 1 2600 135 5 1 2600 1361 5 2 3790 142 5 1 2600 137 5 1 2600 120 5 0 2195 7000 5 50 4913 1100 4 2 775 1 6 0 2713 1100 6 0 2716 2200 5 0 2195 5269 5 50 4725 2100 5 0 2195 5974 5 0 3504 2500 5 0 2195 5671 5 1 2600 1301 5 0 2195 4905 4 2 764 1 5 0 2195 4980 5 0 2195 2103 5 0 3513 900 5 0 3502 4856 6 0 2723 2500 5 0 2195 6106 4 0 1381 7140 5 0 2195 4983 10 0 5815 0 5 0 893 1105 5 0 2195 6672 2000 80 296 0 5 0 2195 5695 5 0 2195 3407 2000 80 213 0 4 0 1381 7323 2000 80 428 0 4 0 1381 7134 5 0 2195 5080 5 0 3523 1700 0 9 3940 20 6 0 2715 400 6 0 2719 2200 4 0 1381 7202 5 0 2195 6685 5 0 2195 6699 2000 80 608 0 2000 80 606 0 6 0 2800 1264 5 0 2195 6802 5 0 3810 1700 5 0 3214 2000 6 0 2722 900 5 0 2195 4919 4 0 1381 7125 5 0 3502 4718 4 0 1381 7152 4 0 1381 7092 5 50 4923 2500 4 2 776 1 5 131 2600 117 5 50 4934 1600 5 131 2600 1243 5 0 2195 5971 5 131 3659 0 5 0 2195 2784 5 0 2195 3645 5 131 2195 6758 5 0 2195 5880 5 6 0 8513 5 1 2600 118 5 1 2600 1255 6 0 2734 1600 5 0 2195 6861 5 2 3790 80 5 50 4922 900 4 0 1381 842 2004 10 25 0 2004 10 25 0 6 0 3790 191 6 0 2800 1458 6 0 2743 600 5 50 4943 400 6 0 2800 1276 5 0 3532 300 1 0 1 2125 5 1 2600 120 5 1 2600 1301 2000 80 578 0 2000 80 561 0 5 0 2195 0 6 4 9 1121 2000 80 650 0 5 0 3819 300 6 0 3790 94 5 0 2195 6753 2004 10 25 0 4 0 1381 7224 5 0 2195 3881 5 2 3790 137 srv03_qfe 5 0 2195 6799 5 2 3669 0 5 2 3644 0 5 2 3790 141 srv03_qfe 5 0 2195 6904 7 0 1701 44 5 0 33668 1 5 0 2195 6713 1 0 0 3 5 0 3510 1100 5 2 3790 161 4 0 1381 7263 5 0 2195 6624 4 0 1381 33562 4 0 1381 7255 4 0 1381 33559 5 1 2600 1515 6 1 0 211 10 0 803 2 5 0 3810 0 5 0 3809 0 5 2 3790 125 4 2 769 1 5 0 2195 3649 4 0 1381 164 5 50 4613 1700 6 0 2712 0300 5 50 4926 2500 4 00 02 7523 6 0 2716 2200 6 0 2713 1100 5 50 4927 2100 4 0 1381 133 3 70 11 40 2000 80 746 0 5 1 2600 128 5 1 2600 1340 5 1 2600 136 5 1 2600 1363 10 00 4205 0000 2000 81 9001 40 2000 81 9041 40 1 0 0 4 5 50 4616 200 5 50 4701 2400 2004 10 21 0 2004 10 21 0 5 1 2600 2525 5 0 2195 6987 4 2 780 1 3 0 1200 291 5 0 2195 5807 4 0 1381 279 5 5 2195 6672 4 1 0 3931 4 1 0 3932 4 1 0 3861 5 1 2600 1125 4 10 2001 0 4 2 764 1 5 0 2195 3649 6 5 6980 57 5 0 2195 2956 9 1 9800 9 5 0 2195 6902 4 0 1381 7265 4 0 1381 33563 5 0 2195 6902 5 1 2600 137 5 1 2600 1364 5 2 3790 142 5 1 2600 1597 3 70 11 46 5 2 3790 239 4 0 1381 7342 4 0 1381 33630 5 0 2195 7017 5 1 2600 1617 5 2 3790 245 5 2 3790 220 5 1 2600 1596 5 2 3790 76 5 1 2600 109 2000 80 747 0 5 1 2600 148 5 1 2600 1517 5 2 3677 144 5 3 0 903 5 2 3790 163 5 2 3790 163 5 1 2600 1254 10 00 6764 0 5 2 3790 227 2000 81 9002 0 5 2 3790 227 srv03_qfe 5 2 3790 225 srv03_qfe 5 1 2600 1613 5 1 2600 2577 9 0 0 3250 6 1 0 9232 6 1 0 9231 10 0 6735 0 6 1 0 9231 2000 81 9042 0 5 1 2600 2598 5 2 3790 252 5 1 2600 1620 6 1 0 9232 5 0 2195 7023 5 0 2195 7021 5 1 2600 1619 5 1 2600 2595 5 2 3790 250 2000 85 1025 0 5 2 3790 233 5 2 3790 1280 4 0 1381 7345 4 0 1381 33632 5 0 2195 7021 5 2 3790 242 5 0 2195 7054 1 0 3705 6021 5 2 3790 309 3 70 11 46 5 0 3900 7009 6 0 3790 241 6 0 2800 1491 6 0 2800 1492 6 0 3790 259 5 0 3528 700 5 0 3825 700 5 1 2600 2709 2000 80 747 0 5 1 0 639 5 1 2600 1710 4 0 1381 7064 4 0 1381 7097 4 0 1381 7058 6 5 5700 21 2000 80 650 0 2000 80 606 0 2000 81 9002 0 2000 80 628 0 5 0 2195 6927 5 0 2258 410 5 1 2600 891 5 2 3677 144 5 3 0 903 2000 80 636 0 2000 80 636 0 2000 80 606 0 2000 80 606 0 2000 81 9042 0 2000 80 606 0 2000 80 606 0 5 131 2600 1123 5 0 1558 6608 5 0 1558 6072 5 0 2195 6159 4 0 1381 7203 4 0 1381 33545 1 0 3705 556 5 0 2195 6928 2000 85 1025 0 4 0 1381 33567 5 0 2195 6929 1 0 0 5 4 0 1381 7269 5 2 3790 185 4 71 2195 6920 4 2 788 1 5 0 3900 6922 6 0 3790 168 6 0 2800 1517 6 0 0 0 6 0 2800 1556 6 0 3790 163 4 72 3841 1100 5 1 2600 155 5 1 2600 1564 5 1 2600 1555 1 1 4322 1085 4 71 1979 1 6 0 2800 1233 6 0 2600 115 4 1 0 3934 1 1 4322 2037 6 0 2742 200 6 0 3790 181 5 1 2600 117 5 1 2600 1243 5 1 2600 112 5 1 2600 1193 6 0 2800 1441 6 0 3790 185 5 50 4942 400 4 1 0 3934 9 0 0 7924 4 0 1381 7267 4 0 1381 7177 4 0 1381 7177 4 0 1381 7202 4 0 1381 7207 9 0 0 6926 8 0 1969 33 5 1 2600 1151 2 62 9119 1 2 53 6202 0 2 12 5118 0 10 0 2609 0 5 5 2558 10 9 0 0 6328 2003 1100 6252 0 5 0 2195 6823 4 0 1381 7116 2000 80 309 0 2000 80 760 0 5 2 3790 121 5 1 2600 1363 6 0 3264 0 10 0 6714 0 5 0 3900 6970 5 3000 2073 13 2000 80 818 0 6 0 2900 2604 5 0 2195 6958 6 0 3790 211 6 0 2600 165 6 0 2600 1579 5 0 2195 6946 6 0 3790 206 5 0 2195 6945 5 2 3790 198 6 9 2800 1580 2000 80 818 0 6 0 2800 1580 4 0 1381 33566 4 0 1381 7270 6 0 2750 166 6 0 3790 212 4 72 3843 3100 4 0 1381 3356 4 0 1381 7268 5 0 2195 6966 2000 80 818 0 4 0 1381 33565 4 0 1381 33574 4 0 1381 7280 4 0 1381 7286 4 0 1381 33577 5 2 3790 205 5 2 3790 205 5 0 2195 6952 5 0 2195 6922 5 1 2600 166 2000 80 818 0 5 1 2600 1580 5 1 2600 1580 6 0 2750 167 5 0 2195 6972 6 0 2800 1584 5 1 2600 1560 6 0 2800 1584 6 0 3790 198 6 0 3790 198 5 5 1877 79 2000 80 818 0 5 2 3790 173 5 2 3790 184 5 2 3790 193 5 2 3790 193 5 1 2600 1567 5 1 2600 1555 5 1 2600 149 5 1 2600 158 5 1 2600 1567 5 1 2600 1555 2000 80 765 0 6 0 2900 2523 6 0 2900 2524 4 0 1381 7299 6 0 3790 219 4 0 1381 33578 2000 80 765 0 5 0 3821 2800 5 0 3534 2800 5 0 4945 2800 6 0 2745 2800 6 0 2745 2800 4 0 1381 7214 4 0 1381 7224 5 0 2195 6810 6 1 5 132 2000 80 765 0 5 0 2195 6011 9 0 0 8930 5 2 3790 359 5 2 3790 2476 6 5 6981 3 5 0 0 799 5 1 0 1044 5 0 2195 7035 2000 80 650 0 5 1 2600 1634 5 1 2600 2622 5 2 3790 280 6 0 3790 280 6 0 3790 274 2000 80 213 0 6 0 2800 1643 6 0 2900 2620 5 0 3900 7032 5 0 2195 7035 6 0 3790 279 6 0 2900 2627 6 0 2800 1498 6 0 2800 1499 5 0 3539 2400 5 0 3826 2400 3 0 1200 408 2000 80 778 0 2000 80 765 0 5 0 3900 7036 2000 80 798 0 2000 80 765 0 2000 80 765 0 2000 80 606 0 2000 80 606 0 2000 80 606 0 2000 80 606 0 2000 80 628 0 2 0 390 16 2000 80 818 0 2000 80 818 0 2000 80 811 0 2000 80 765 0 5 2 3790 2442 5 2 3790 329 5 1 2600 160 5 1 2600 1684 2000 80 816 0 2000 80 800 0 5 00 2195 6862 3 0 1200 430 2000 80 223 0 2000 80 223 0 2000 80 223 0 2000 80 223 0 2000 80 384 0 5 2 3790 315 5 0 3526 800 5 0 3813 800 5 50 4937 800 6 0 2737 800 6 0 2800 1400 6 0 3790 118 6 0 3790 327 6 0 3790 2440 5 0 2195 6870 6 0 2900 2668 ^.*asp\.dll.*$ 4 ^.*ism\.dll.*$ ^.*idq\.dll.*$ HttpRedirect ^http:*,PERMANENT,* 5.0 1 ^2\.5.*$ ^2\.6.*$ ^2\.70.*$ ^2\.71.*$ ^2\.8.*$ 3 0 4 1 Microsoft ISA Server 2000 Updates 1 1 1 65 1,0,4322,0 3 3 1,0,3705,2 1,0,3705,3 1 3 3 1 KB888258 1 1 1 1 1 1 1 1 1 This will match any KB834707 rather give a list such as KB834707-ie501sp3-20040929.121357,etc 1 3 4 4 4.1 1 1 1 1 1.1 2.2 5,50,4807,1700 6,0,2600,0000 6,0,3790,0 6,0,2800,1106 5.1.0639 6.00.2600.0000 ^2\.1.*$ 1 1 1 1 1 1 1 3 3 3 3 3 6.2.0205 2 10.0.4333.0 10.0.6626.0 5.1 3.0 6.0.2900.2180 1 1 1 1 1 1 1 1 3.5 1 1 1 4 0 1 1 1 x64 6.0.2600.0000 ^Service Pack [4-9]|\d{2,}$ 5 ^Service Pack [3-9]|\d{2,}$ 5.50.4134.0100 5.50.4134.0600 5.50.4522.1800 1 1 5.00.2919.800 5.00.2919.3800 5.00.2919.6307 5.00.2920.0000 5.00.3103.1000 5.00.3105.0106 5.00.3314.2101 1 1 1 1 4 1 1 1 1 1 1 1 1 1 Service Pack 2 1 1 1 RASPHONE.PBK 1 4 1 8.00.194 2 1 1 4 1 1 1 3 gopher:// 1 4 1 816456 1 ^Service Pack [4-9]|\d{2,}$ .hta 1 Y 1 1 3 1 1 1 ^Service Pack [2-9]|\d{2,}$ 1 3 1 2 1 0 1 1 5.0 1 4 1 4 4 1 1 1 1 1 1 8.0.0.4477 1 1 1 1 1 4 1 331066 2 1 4 1 Installed 4 Service Pack 6 5.50.4134.0100 5.50.4134.0600 1 5.50.4522.1800 1 1 6.0.2600.0000 1 1 1 1 1 3 1 3 1 ^2\.6.* 1 0 ^2\.7.* Y 1 1 1 1 1 Windows 98 1 0 0 0 ^Windows.* 4 2 Service Pack 1 WinNT 4 ^4\.08\.01.*$ ^4\.08\.02.*$ ^4\.09.*$ 1 1 1 ^.*ServerNT.*$ ^Service Pack [1-9]|\d{2,}$ ^5\.[1-2]$ ^.*LanmanNT.*$ 1 1 Terminal Server 6.2.0208 1 1 1 1 4 1 Microsoft Exchange 2000 8.00.194 ^4\.07.* 1 ^4\.08\.00.* 1 ^4\.08\.01.* 1 ^4\.08\.02.* 1 ^4\.09\.00.* 1 0 8.5 1 1 1 1 1 1 1 1 16384 1 1 1 1 1 0 5,6,0,8513 6.00.2800.1106 5,1,0,8513 5,5,0,8513 1 1 2653 2 6.00.3790.0000 1 1 10.0.4330.0 11.0.6252.7 Installed Installed 1 KB899753 11.0.5614.0 10.0.8326.0 10.2.5110 11.0.3216.5614 9.00.9327 5.50.4807.2300 Installed Q833989 9.00.9327 1 1 ^Service Pack [0-4]$ ^Service Pack [5-9]|\d{2,}$ 5.00.3700.1000 1 1 1 1 1 1 5.00.3502.1000 Windows ME 1 1 1 .*zipfldr\.dll.* 1 1 1 1 1 5.00.3315.1000 1 1 1 1 6.00.2900.2180 1 1 1 1 1 6 3 CoPNGFilter Class 1 1 5.2 1 1 1 C:\Program Files\Windows NT\hypertrm.exe /t %1 1 ia64 4 x86 4.0 1 ^Service Pack [0-2]$ 1 9.00.00.2980 1 1.1 1.1 1 1 1 1 1 1 1 10.0.8326.0 10.0.6626.0 1 1 4 1 Non-pejorative check