CVE-2003-0525 : The getCanonicalPath function in Windows NT 4.0 may free memory that it does not

The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.

Published 2003-08-27 04:00:00

Updated 2018-10-12 21:32:46

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2003-0525

Microsoft » Windows Nt » Version: 4.0 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP2 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP1 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP2 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP4 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP6 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP6 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP2 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP3 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP3 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update Sp6a Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update Sp6a Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP1 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP1 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP5 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP5 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP5 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:*:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP3 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP4 Enterprise Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:enterprise_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP4 Terminal Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*
Matching versions
Microsoft » Windows Nt » Version: 4.0 Update SP6 Server Edition
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:server:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2003-0525

EPSS FAQ

0.40%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2003-0525

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

References for CVE-2003-0525

Jump to

Vulnerability Details : CVE-2003-0525

Products affected by CVE-2003-0525

Exploit prediction scoring system (EPSS) score for CVE-2003-0525

CVSS scores for CVE-2003-0525

References for CVE-2003-0525