4.0 SP6 Terminal Server * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2008-4609	16	DoS	2008-10-20	2021-07-07	7.1	None	Remote	Medium	Not required	None	None	Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
2	CVE-2006-2379	119	Exec Code Overflow	2006-06-13	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.
3	CVE-2006-1591		Exec Code Overflow	2006-04-03	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
4	CVE-2006-1184		DoS	2006-05-10	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
5	CVE-2006-0034	119	Exec Code Overflow	2006-05-10	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
6	CVE-2006-0010	119	Exec Code Overflow	2006-01-10	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.
7	CVE-2005-1935		Exec Code Overflow	2005-06-13	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library (MSASN1.DLL) allows remote attackers to execute arbitrary code via nested constructed bit strings, which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory, as demonstrated using a SPNEGO token with a constructed bit string during HTTP authentication, and a different vulnerability than CVE-2003-0818. NOTE: the researcher has claimed that MS:MS04-007 fixes this issue.
8	CVE-2005-1184		DoS	2005-05-02	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number, which generates a large number of "keep alive" packets. NOTE: some followups indicate that this issue could not be replicated.
9	CVE-2005-0416		Exec Code Overflow	2005-04-27	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow.
10	CVE-2005-0050	20	DoS Exec Code	2005-05-02	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
11	CVE-2004-1361		Exec Code Overflow	2004-12-23	2019-04-30	5.0	None	Remote	Low	Not required	None	Partial	None
Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file, which leads to a heap-based buffer overflow.
12	CVE-2004-1306		Exec Code Overflow	2004-12-31	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
13	CVE-2004-1305		DoS	2004-12-23	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.
14	CVE-2004-1080		Exec Code	2005-01-10	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."
15	CVE-2004-0901		Exec Code	2005-01-10	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.
16	CVE-2004-0900		Exec Code	2005-01-10	2018-10-12	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."
17	CVE-2004-0899		DoS	2005-01-10	2018-10-12	5.0	None	Remote	Low	Not required	None	None	Partial
The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability."
18	CVE-2004-0893		+Priv	2005-01-10	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."
19	CVE-2004-0571		Exec Code	2005-01-10	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.
20	CVE-2004-0568		Exec Code Overflow	2005-01-10	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.
21	CVE-2004-0567		DoS Exec Code Overflow	2004-12-31	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability."
22	CVE-2004-0210		Exec Code Overflow	2004-08-06	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.
23	CVE-2004-0201		Exec Code Overflow	2004-08-06	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.
24	CVE-2003-0825	20	DoS Exec Code	2004-03-03	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.
25	CVE-2003-0818		Exec Code Overflow	2004-03-03	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.
26	CVE-2003-0813		DoS	2003-11-17	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.
27	CVE-2003-0717		Exec Code Overflow	2003-11-17	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
28	CVE-2003-0715		Exec Code Overflow	2003-09-17	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.
29	CVE-2003-0711		Exec Code Overflow	2003-11-17	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.
30	CVE-2003-0661		+Info	2003-10-20	2019-04-30	5.0	None	Remote	Low	Not required	Partial	None	None
The NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0, 2000, XP, and Server 2003 may include random memory in a response to a NBNS query, which could allow remote attackers to obtain sensitive information.
31	CVE-2003-0660		Exec Code	2003-11-17	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.
32	CVE-2003-0659		Exec Code Overflow	2003-11-17	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
33	CVE-2003-0528		Exec Code Overflow	2003-09-17	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.
34	CVE-2003-0525		DoS Mem. Corr.	2003-08-27	2018-10-12	5.0	None	Remote	Low	Not required	None	None	Partial
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
35	CVE-2003-0352		Exec Code Overflow	2003-08-18	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.
36	CVE-2003-0345		DoS Exec Code Overflow	2003-08-18	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required.
37	CVE-2003-0112		Overflow +Priv	2003-05-12	2019-04-30	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.
38	CVE-2003-0010		Exec Code Overflow	2003-03-24	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
39	CVE-2003-0003		Exec Code Overflow	2003-02-07	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.
40	CVE-2002-1561		DoS	2003-04-02	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference.
41	CVE-2002-1325			2002-12-23	2019-04-30	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
42	CVE-2002-1260		Bypass	2002-12-23	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
43	CVE-2002-1258			2002-12-23	2019-04-30	5.0	None	Remote	Low	Not required	Partial	None	None
Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error.
44	CVE-2002-1257		Exec Code	2002-12-23	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
45	CVE-2002-0863			2002-10-11	2019-04-30	5.0	None	Remote	Low	Not required	Partial	None	None
Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."
46	CVE-2002-0862			2002-10-04	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
47	CVE-2002-0724		DoS Overflow	2002-09-24	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service".
48	CVE-2002-0694		Exec Code	2002-10-10	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File."
49	CVE-2002-0693		Exec Code Overflow	2002-10-10	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.
50	CVE-2002-0366		Exec Code Overflow	2002-07-03	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.

Total number of vulnerabilities : 53 Page : 1 (This Page)2