CVE-2005-3176
Microsoft Windows 2000 before Update Rollup 1 for SP4 does not record the IP address of a Windows Terminal Services client in a security log event if the client connects successfully, which could make it easier for attackers to escape detection.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Microsoft Windows 2000 before Update Rollup 1 for SP4 does not record the IP address of a Windows Terminal Services client in a security log event if the client connects successfully, which could make it easier for attackers to escape detection.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.91% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/windows 2000
- Source
- cve@mitre.org
References
- http://support.microsoft.com/kb/891076Patch, Vendor Advisory
- http://support.microsoft.com/kb/900345Patch, Vendor Advisory
- http://support.microsoft.com/kb/891076Patch, Vendor Advisory
- http://support.microsoft.com/kb/900345Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.