vulnwire
9.3crit

CVE-2003-0825in critical feed

The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly va…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
12.2%
percentile 96%
Public exploits
0
none known

The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.

Exploit prediction (EPSS)

12.16% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/15037 · vdb-entry, x_refsource_XF, x_transferred
  • ciac.org /ciac/bulletins/o-077.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • osvdb.org /3903 · vdb-entry, x_refsource_OSVDB, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A801 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A800 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A704 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityfocus.com /bid/9624 · vdb-entry, x_refsource_BID, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2004/ms04-006 · vendor-advisory, x_refsource_MS, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A802 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • kb.cert.org /vuls/id/445214 · third-party-advisory, x_refsource_CERT-VN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.