CVE-2011-0040

Microsoft Active Directory on Windows Server 2003 SP2 - DoS

Title source: llm

Description

The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."

References (8)

Core 8

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2011/0319

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-005

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/70825

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1025042

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/43215

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/64915

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/46145

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12485

Scores

EPSS 0.2276

EPSS Percentile 97.5%

Details

CWE

CWE-20

Status published

Products (1)

microsoft/windows_2003_server (3 CPE variants)

Published Feb 09, 2011

Tracked Since Feb 18, 2026