CVE-2003-0660
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 24.47% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/windows 2000 · microsoft/windows 2003 server · microsoft/windows nt · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://www.cert.org/advisories/CA-2003-27.htmlUS Government Resource
- http://www.kb.cert.org/vuls/id/838572Patch, Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/8830Patch, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-041
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13422
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A185
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A198
- http://www.cert.org/advisories/CA-2003-27.htmlUS Government Resource
- http://www.kb.cert.org/vuls/id/838572Patch, Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/8830Patch, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-041
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13422
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A185
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A198
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.