Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Windows 2000 Active Directory can be tricked into running code

CVE-2008-4023 · published 18 years ago
Summary

The Active Directory service in Windows 2000 Service Pack 4 does not handle certain directory requests correctly, allowing a specially crafted request to cause a memory error and run attacker code. This could let a remote attacker take control of the server. Install the Microsoft security update for Windows 2000 or upgrade to a newer, supported operating system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2000 All versions
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
Original advisory text
Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote attackers to execute arbitrary code via a crafted request, ...
Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote attackers to execute arbitrary code via a crafted request, aka "Active Directory Overflow Vulnerability."
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
39% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published15 Oct 2008
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2008-4023 · NVD
Track software like this
Free during beta