CVE-2002-1256
The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the…
Does this matter?
Lower severity and a low EPSS score (5.41%). Track it; it rarely justifies an emergency change on its own.
Description
The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 5.41% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/windows 2000 · microsoft/windows 2000 terminal services · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/6367
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10843
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277
- http://www.securityfocus.com/bid/6367
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10843
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.