CVE-2007-0040

Windows Active Directory - Remote Code Execution via LDAP Request with Convertible Attributes

Title source: llm
STIX 2.1

Description

The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/24800
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Various Sources vendor-advisory x_refsource_hp
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2012
Third Party Advisory third-party-advisory x_refsource_iss
http://www.iss.net/threats/267.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018355
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26002
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/35960
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/487905
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2481

Scores

EPSS 0.3917
EPSS Percentile 98.5%

Details

Status published
Products (2)
microsoft/windows_2000
microsoft/windows_2003_server (5 CPE variants)
Published Jul 10, 2007
Tracked Since Feb 18, 2026