Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

HyperTerminal on Windows NT/2000/XP/2003 can run malicious code

CVE-2004-0568 · published 21 years ago
Summary

The HyperTerminal program in Windows NT, Windows 2000, Windows XP, and Windows Server 2003 does not check how much data it reads from a saved session file. An attacker can send a specially crafted .ht file, web link, or Telnet address that tricks HyperTerminal into executing any program they choose. Install any available Microsoft updates for HyperTerminal or stop using the program on these systems and avoid opening unknown HyperTerminal files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2000 All versions
cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
microsoft windows_2003_server datacenter_64-bit
enterprise
enterprise_64-bit
r2
standard
web
cpe:2.3:o:microsoft:windows_2003_server:datacenter_64-bit:sp1_beta_1:*:*:*:*:*:*
microsoft windows_nt 4.0
cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*
microsoft windows_xp All versions
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
Original advisory text
HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote...
HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
35% chance of attack within 30 days
Timeline
Published10 Jan 2005
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2004-0568 · NVD
Track software like this
Free during beta