CVE-2011-0039
First published: Wed Feb 09 2011(Updated: )
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows Server 2003 | =sp2 | |
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows XP | =sp3 | |
| Microsoft Windows Server 2003 | =sp2 | |
| Microsoft Windows Server 2003 | =sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.vupen.com/english/advisories/2011/0327
- http://www.securityfocus.com/bid/46152
- http://secunia.com/advisories/43253
- http://www.securitytracker.com/id?1025049
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12537
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-014
Frequently Asked Questions
What is the severity of CVE-2011-0039?
CVE-2011-0039 is considered a critical vulnerability due to its potential to allow unauthorized privilege escalation.
How do I fix CVE-2011-0039?
To fix CVE-2011-0039, it is recommended to apply the latest security updates provided by Microsoft for affected versions of Windows XP and Windows Server 2003.
Who is affected by CVE-2011-0039?
CVE-2011-0039 affects local users of Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 without the latest security patches.
What type of vulnerability is CVE-2011-0039?
CVE-2011-0039 is a privilege escalation vulnerability found in the Local Security Authority Subsystem Service (LSASS) of affected Windows systems.
When was CVE-2011-0039 discovered?
CVE-2011-0039 was reported in January 2011, highlighting a critical flaw in older Microsoft operating systems.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/microsoft
- product/windows 2003 server
- canonical/microsoft windows 2003 server
- product/windows xp
- canonical/microsoft windows xp
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/microsoft windows server 2003
- version/microsoft windows server 2003/sp2
- version/microsoft windows xp/sp2
- version/microsoft windows xp/sp3