CVE-2005-0044
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 33.4%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 33.36% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/exchange server · microsoft/windows 2000 · microsoft/windows 2003 server · microsoft/windows 98 · microsoft/windows 98se · microsoft/windows me · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://www.kb.cert.org/vuls/id/927889Patch, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA05-039A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-012
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19109
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1180
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2917
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3568
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4499
- http://www.kb.cert.org/vuls/id/927889Patch, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA05-039A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-012
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19109
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1180
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2917
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3568
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4499
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.