Vulnerabilities > CVE-2007-0040 - Remote Code Execution vulnerability in Microsoft Windows 2000 and Windows 2003 Server

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
microsoft
critical
nessus
NVD
Published: 2007-07-10
Updated: 2019-04-30

Summary

The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."

Vulnerable Configurations

Part Description Count
OS
Microsoft
6

Nessus

  • NASL familyWindows
    NASL idSMB_KB926122.NASL
    descriptionThe remote version of Active Directory contains a flaw in the LDAP request handler code that may allow an attacker to execute code on the remote host. On Windows 2000, an anonymous attacker can exploit this flaw by sending a specially crafted LDAP packet. Additionally, Active Directory is affected by a remote denial of service vulnerability.
    last seen2020-06-01
    modified2020-06-02
    plugin id25699
    published2007-07-11
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/25699
    titleMS07-039: Vulnerability in Windows Active Directory Could Allow Remote Code Execution (926122) (uncredentialed check)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS07-039.NASL
    descriptionThe remote version of Active Directory contains a flaw in the LDAP request handler code that allows an attacker to execute code on the remote host. On Windows 2000 an anonymous attacker can exploit this flaw by sending a specially crafted LDAP packet. On Windows 2003 valid credentials are needed to exploit it. Additionally, the Active Directory is affected by a remote denial of service vulnerability.
    last seen2020-06-01
    modified2020-06-02
    plugin id25690
    published2007-07-10
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/25690
    titleMS07-039: Microsoft Windows Active Directory LDAP Service Remote Code Execution (926122)

Oval

accepted2007-08-20T08:04:39.839-04:00
classvulnerability
contributors
nameSudhir Gandhe
organizationSecure Elements, Inc.
definition_extensions
  • commentMicrosoft Windows 2000 SP4 or later is installed
    ovaloval:org.mitre.oval:def:229
  • commentMicrosoft Windows Server 2003 SP1 (x86) is installed
    ovaloval:org.mitre.oval:def:565
  • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
    ovaloval:org.mitre.oval:def:1935
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
    ovaloval:org.mitre.oval:def:2161
descriptionThe LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."
familywindows
idoval:org.mitre.oval:def:2012
statusaccepted
submitted2007-07-10T18:34:24
titleWindows Active Directory Remote Code Execution Vulnerability
version70

References