CVE-2005-0045

The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.

Affected products

Windows 2000, Windows Nt 4.0, Windows Server 2003, Windows Xp

Microsoft Windows 2000

All versions

Microsoft Windows 2003 Server

= enterprise, enterprise_64-bit, R2, standard, web

Microsoft Windows Nt

= 4.0

Microsoft Windows Xp

All versions

Fix

Available

CVSS 2.0

7.5 HIGH

EPSS

70.3% (99th percentile)

NVD status

Modified

Published

2005-02-08