Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Windows 2000 can crash and allow privilege escalation

CVE-2003-0605 · published 23 years ago
Summary

Windows 2000 Service Pack 3 and 4 contain a flaw in a system communication component that can be triggered to make the computer stop working. If the crash is caused locally, an attacker could then take control of a privileged system channel to increase their rights on the machine. Apply the Microsoft updates for Windows 2000 or disable the affected component to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2000 All versions
cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
Original advisory text
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, v...
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
59% chance of attack within 30 days
Timeline
Published27 Aug 2003
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2003-0605 · NVD
Track software like this
Free during beta