Vulnerability in Microsoft Windows 2000
CVE-2003-0813
A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
EPSS: 0.153 (96.4th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Windows_2000
- Microsoft Windows_98
- Microsoft Windows_nt — versions 4.0
- Microsoft Windows_server_2003
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (mailing-list, URL Repurposed, x_refsource_FULLDISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
- cve@mitre.org (mailing-list, URL Repurposed, x_refsource_FULLDISC)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Patch, Third Party Advisory, third-party-advisory)
- cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
- cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_CERT, Broken Link, third-party-advisory)
- cve@mitre.org (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)
- cve@mitre.org (mailing-list, Third Party Advisory, x_refsource_NTBUGTRAQ)
- cve@mitre.org (x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2003-0813?
- CVE-2003-0813 is a vulnerability in Microsoft Windows 2000, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. Published 2003-11-17.
- Is CVE-2003-0813 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.