CVE-2005-2120
7.6 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.03 Low
EPSS
Percentile
90.9%
Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.
| CPE | Name | Operator | Version |
|---|---|---|---|
| microsoft:windows_xp | microsoft windows xp | eq | * |
| microsoft:windows_2000 | microsoft windows 2000 | eq | * |
References
secunia.com/advisories/17166
secunia.com/advisories/17172
secunia.com/advisories/17223
securityreason.com/securityalert/71
securitytracker.com/id?1015042
support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
www.eeye.com/html/research/advisories/AD20051011c.html
www.kb.cert.org/vuls/id/214572
www.osvdb.org/18830
www.securityfocus.com/bid/15065
www.us-cert.gov/cas/techalerts/TA05-284A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-047
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1244
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1328
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1519
Related
7.6 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.03 Low
EPSS
Percentile
90.9%