VulnerabilityModified
CVE-2002-2077
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
MEDIUM 5.0EPSS 15.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 15.87% probability · 97th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/windows 2000
- Source
- cve@mitre.org
References
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq300367
- http://www.bindview.com/Services/razor/Advisories/2002/adv_dcom.cfmPatch, Vendor Advisory
- http://www.iss.net/security_center/static/8739.phpPatch
- http://www.securityfocus.com/bid/4410Patch
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq300367
- http://www.bindview.com/Services/razor/Advisories/2002/adv_dcom.cfmPatch, Vendor Advisory
- http://www.iss.net/security_center/static/8739.phpPatch
- http://www.securityfocus.com/bid/4410Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.