CVE-2007-2999: Low severity Microsoft Windows 2003 Server vulnerability
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account names.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2999?
CVE-2007-2999 is considered a medium severity vulnerability due to its potential for user enumeration attacks.
How does CVE-2007-2999 impact user account security?
CVE-2007-2999 allows attackers to determine valid Active Directory usernames by exploiting the different error messages during failed login attempts.
What versions of Windows Server are affected by CVE-2007-2999?
CVE-2007-2999 affects Microsoft Windows Server 2003 versions SP1, SP2, and the Gold edition.
How can I mitigate CVE-2007-2999 in my environment?
Mitigating CVE-2007-2999 can be accomplished by implementing account lockout policies and configuring error messages to be generic.
Is there a patch available for CVE-2007-2999?
There is no specific patch for CVE-2007-2999, but upgrading to a newer version of Windows Server can eliminate the risk.