CVE-2013-3868

Microsoft Active Directory Lightweight Directory Service (AD LDS) on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 and Active Directory Services on Windows Server 2008 SP2 and R2 SP1 and Server 2012 allow remote attackers to cause a denial of service (LDAP directory-service outage) via a crafted LDAP query, aka "Remote Anonymous DoS Vulnerability."

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.us-cert.gov/ncas/alerts/TA13-253A	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079
http://www.us-cert.gov/ncas/alerts/TA13-253A	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
	cpe:2.3:o:microsoft:windows_server_2008::sp2:x86:::::

Configuration 2 (hide)

OR	cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*
	cpe:2.3:o:microsoft:windows_8:-:-:x64:::::*
	cpe:2.3:o:microsoft:windows_8:-:-:x86:::::*

Configuration 3 (hide)

OR	cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*
	cpe:2.3:o:microsoft:windows_7::sp1:x64:::::
	cpe:2.3:o:microsoft:windows_7::sp1:x86:::::

Configuration 4 (hide)

OR	cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*

Configuration 5 (hide)

OR	cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*
	cpe:2.3:o:microsoft:windows_vista::sp2::::::*

History

21 Nov 2024, 01:54

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/ncas/alerts/TA13-253A - US Government Resource~~	() http://www.us-cert.gov/ncas/alerts/TA13-253A - US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079 -

07 Dec 2023, 18:38

Type	Values Removed	Values Added
CPE	cpe:2.3:o:microsoft:windows_vista::sp2:x64:::::

Information

Published : 2013-09-11 14:03

Updated : 2025-04-11 00:51

NVD link : CVE-2013-3868

Mitre link : CVE-2013-3868

CVE.ORG link : CVE-2013-3868

JSON object : View

Products Affected

microsoft

windows_7
windows_server_2008
windows_8
active_directory_lightweight_directory_service
windows_vista
windows_server_2012

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-3868", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-09-11T14:03:48.347", "references": [{"url": "http://www.us-cert.gov/ncas/alerts/TA13-253A", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/ncas/alerts/TA13-253A", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-079", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Active Directory Lightweight Directory Service (AD LDS) on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 and Active Directory Services on Windows Server 2008 SP2 and R2 SP1 and Server 2012 allow remote attackers to cause a denial of service (LDAP directory-service outage) via a crafted LDAP query, aka \"Remote Anonymous DoS Vulnerability.\""}, {"lang": "es", "value": "Microsoft Active Directory Lightweight Directory Service (AD LDS) en Windows Vista SP2, Windows Server 2008 SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1 y Windows 8; y Active Directory Services en Windows Server 2008 SP2 and R2 SP1 y Server 2012 permite a atacantes remotos causar una denegaci\u00f3n de servicio (agotamiento de directory-service LDAP) a trav\u00e9s de una consulta LDAP manipulada, tambien conocido como \"Vulnerabilidad de DoS An\u00f3nimo Remoto\"."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E988C43E-C9C2-4ECC-8FF3-237ADE080691"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4945F25F-2828-4D03-930B-A109BA73E00C"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFF81F4B-7D92-4398-8658-84530FB8F518"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32C28EC2-8A34-4E30-A76A-86921D7332C1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E988C43E-C9C2-4ECC-8FF3-237ADE080691"}, {"criteria": "cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE8E7D74-0DCB-4633-B502-EDC2112229BA"}, {"criteria": "cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DAA2E6F-A666-4136-8F6B-E35C313CAB2B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E988C43E-C9C2-4ECC-8FF3-237ADE080691"}, {"criteria": "cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FA15D65-7C32-4C7A-9915-746AB3F454EE"}, {"criteria": "cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "976EFC05-9B37-4661-AD34-4FFDB5AB48E0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E988C43E-C9C2-4ECC-8FF3-237ADE080691"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E988C43E-C9C2-4ECC-8FF3-237ADE080691"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0D2704-C058-420B-B368-372D1129E914"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}

5.0 /10