CVE-2004-0119

moderate-risk

Published 2004-06-01

The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.

Do I need to act?

23.2% chance of exploitation in next 30 days

EPSS score — higher than 77% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (3)

Windows 2000

Windows Xp

Windows Server 2003

Affected Vendors

Microsoft

References (20)

Broken Link http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0081.html

Broken Link http://www.ciac.org/ciac/bulletins/o-114.shtml

Patch http://www.kb.cert.org/vuls/id/638548

Broken Link http://www.securityfocus.com/bid/10113

Broken Link http://www.us-cert.gov/cas/techalerts/TA04-104A.html

Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-01...

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/15715

Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...

Broken Link http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0081.html

Broken Link http://www.ciac.org/ciac/bulletins/o-114.shtml

Patch http://www.kb.cert.org/vuls/id/638548

Broken Link http://www.securityfocus.com/bid/10113

Broken Link http://www.us-cert.gov/cas/techalerts/TA04-104A.html

Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-01...

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/15715

Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 14/34 · Moderate

Exposure 9/34 · Low