Description
The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.
References
- O-114 third-party-advisory government-resource
- VU#638548 third-party-advisory
- 10113 vdb-entry
- win-spp-bo(15715) vdb-entry
- MS04-011 vendor-advisory
- 20040414 NSFOCUS SA2004-01 : DoS Vulnerability in Microsoft Windows SPNEGO Protocol Decoding mailing-list
- oval:org.mitre.oval:def:1808 vdb-entry signature
- TA04-104A third-party-advisory
- oval:org.mitre.oval:def:1962 vdb-entry signature
- oval:org.mitre.oval:def:1997 vdb-entry signature