CVE-2004-0574

CRITICAL 10.0CVE-2004-0574 · Published 03/11/2004 · updated 16/06/2026

Package	Affected versions	Patched versions
exchange server microsoft	`= 2000= 2003`	No fix yet

Description

The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.

References

marc.info · Mailing List
ciac.org/ciac/bulletins/p-012.shtml · Broken Link
coresecurity.com/common/showdoc.php · Third Party Advisory
kb.cert.org/vuls/id/203126 · Patch
docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-036 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/17641 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/17661 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A246 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4392 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5021 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5070 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5926 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free