5 - MS04-016

Executive Summary

Informations
Name	MS04-016	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability in DirectPlay Could Allow Denial of Service (839643)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1027

Oval ID:	oval:org.mitre.oval:def:1027
Title:	Windows 2000 DirectPlay Denial of Service
Description:	IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0202	Version:	1
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft DirectPlay
Definition Synopsis:
Windows 2000 is installed AND Vulnerable versions of DirectX Unpatched DirectX 7.0 DirectX 7.0x Installed AND File %windir%\system32\dplayx.dll version is less than 5.0.2195.6927 AND NOT Patch Windows2000-KB839643-x86-ENU.EXE Installed OR Unpatched DirectX 8.0x DirectX 8.0x Installed AND File %windir%\system32\dplayx.dll version is less than 5.0.2258.410 AND NOT Patch DirectX80-KB839643-x86-ENU Installed OR Unpatched DirectX 8.1x DirectX 8.1x Installed AND File %windir%\system32\dplayx.dll version is less than 5.1.2600.891 AND NOT Patch DirectX81-KB839643-x86-ENU Installed OR Unpatched DirectX 8.2x DirectX 8.2x Installed AND File %windir%\system32\dplayx.dll version is less than 5.2.3677.144 AND NOT Patch DirectX82-KB839643-x86-ENU Installed OR Unpatched DirectX 9.0x DirectX 9.0x Installed AND File %windir%\system32\dplayx.dll version is less than 5.3.0.903 AND NOT Patch DirectX90-KB839643-x86-ENU Installed

Definition Id: oval:org.mitre.oval:def:2190

Oval ID:	oval:org.mitre.oval:def:2190
Title:	Windows XP (32-Bit) DirectPlay Denial of Service
Description:	IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0202	Version:	7
Platform(s):	Microsoft Windows XP	Product(s):	DirectX
Definition Synopsis:
Windows XP is installed AND 32-Bit version of Windows is installed AND DirectX without KB839643 Installed DirectX 8.2 without DirectX82-KB839643-x86-ENU.EXE Installed the version of dplayx.dll is less than 5.2.3677.144 AND DirectX 8.2 Installed AND NOT Patch DirectX82-KB839643-x86-ENU Installed OR DirectX 9.0 without DirectX9-KB839643-x86-ENU.EXE Installed the version of dplayx.dll is less than 5.3.0.903 AND DirectX 9.0x Installed AND NOT Patch DirectX90-KB839643-x86-ENU Installed OR DirectX 8.1 without WindowsXP-KB839643-x86-ENU.EXE Installed DirectX 8.1 without WindowsXP-KB839643-x86-ENU.EXE Installed on XP Gold the version of dplayx.dll is less than 5.1.2600.148 AND NOT Win2K/XP/2003 is patched AND DirectX 8.1x Installed AND NOT the patch kb839643 is installed OR DirectX 8.1 without WindowsXP-KB839643-x86-ENU.EXE Installed on XP SP1 the version of dplayx.dll is less than 5.1.2600.1517 AND DirectX 8.1x Installed AND the patch kb839643 is installed AND NOT Win2K/XP/2003 service pack 1 (or later) is installed

Definition Id: oval:org.mitre.oval:def:2413

Oval ID:	oval:org.mitre.oval:def:2413
Title:	Windows XP (64-Bit) DirectPlay Denial of Service
Description:	IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0202	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	DirectX
Definition Synopsis:
DirectX 8.1 without kb839643 installed the version of dplayx.dll is less than 5.2.3790.163 on 64-bit edition AND DirectX 8.1x Installed AND NOT the patch kb839643 is installed AND Windows XP 64-bit with SP1 (or earlier) installed Windows XP (sp1 or earlier) is installed Windows XP is installed AND NOT Win2K/XP/2003 service pack 2 (or later) is installed

Definition Id: oval:org.mitre.oval:def:2516

Oval ID:	oval:org.mitre.oval:def:2516
Title:	Windows Server 2003 (32-Bit) DirectPlay Denial of Service
Description:	IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0202	Version:	1
Platform(s):	Microsoft Windows Server 2003	Product(s):	DirectX
Definition Synopsis:
Windows Server 2003 is installed AND 32-Bit version of Windows is installed AND DirectX without KB839643 Installed on Windows Server 2003 DirectX 8.2 without DirectX82-KB839643-x86-ENU.EXE Installed the version of dplayx.dll is less than 5.2.3677.144 AND DirectX 8.2 Installed AND NOT Patch DirectX82-KB839643-x86-ENU Installed OR DirectX 9.0 without DirectX9-KB839643-x86-ENU.EXE Installed the version of dplayx.dll is less than 5.3.0.903 AND DirectX 9.0x Installed AND NOT Patch DirectX90-KB839643-x86-ENU Installed OR DirectX 8.1 without WindowsServer2003-KB839643-x86-ENU.EXE Installed the version of dplayx.dll is less than 5.2.3790.163 AND DirectX 8.1x Installed AND NOT the patch kb839643 is installed

Definition Id: oval:org.mitre.oval:def:2705

Oval ID:	oval:org.mitre.oval:def:2705
Title:	Windows XP/Server 2003 DirectPlay Denial of Service (Test 2)
Description:	IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0202	Version:	2
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003	Product(s):	DirectX
Definition Synopsis:
Windows XP or Windows Server 2003 is installed AND 64-Bit version of Windows is installed AND DirectX 8.1 without kb839643 installed the version of dplayx.dll is less than 5.2.3790.163 on 64-bit edition AND DirectX 8.1x Installed AND NOT the patch kb839643 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Directx cpe:2.3:a:microsoft:directx:9.0b:::::::* cpe:2.3:a:microsoft:directx:9.0a:::::::* cpe:2.3:a:microsoft:directx:8.2:::::::* cpe:2.3:a:microsoft:directx:8.1b:::::::* cpe:2.3:a:microsoft:directx:8.1a:::::::* cpe:2.3:a:microsoft:directx:8.1:::::::* cpe:2.3:a:microsoft:directx:8.0a:::::::* cpe:2.3:a:microsoft:directx:8.0:::::::* cpe:2.3:a:microsoft:directx:7.1:::::::* cpe:2.3:a:microsoft:directx:7.0a:::::::* cpe:2.3:a:microsoft:directx:7.0:::::::*	11
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000::sp4::::::* cpe:2.3:o:microsoft:windows_2000::sp2::::::* cpe:2.3:o:microsoft:windows_2000::sp3::::::*	3
Os	Microsoft Windows 2003 Server cpe:2.3:o:microsoft:windows_2003_server:web:::::::* cpe:2.3:o:microsoft:windows_2003_server:standard::64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:r2::datacenter_64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:r2::64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:::::::* cpe:2.3:o:microsoft:windows_2003_server:enterprise::64-bit:::::	6
Os	Microsoft Windows 98 cpe:2.3:o:microsoft:windows_98::gold::::::*	1
Os	Microsoft Windows 98Se cpe:2.3:o:microsoft:windows_98se::::::::	1
Os	Microsoft Windows Me cpe:2.3:o:microsoft:windows_me::::::::	1
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp::sp1:home::::: cpe:2.3:o:microsoft:windows_xp::sp1:64-bit::::: cpe:2.3:o:microsoft:windows_xp:::home:::::* cpe:2.3:o:microsoft:windows_xp:::64-bit:::::* cpe:2.3:o:microsoft:windows_xp::gold:professional:::::	5

OpenVAS Exploits

Date	Description
2005-11-03	Name : Vulnerability in DirectPlay Could Allow Denial of Service (839643) File : nvt/smb_nt_ms04-016.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
6742	Microsoft DirectPlay Packet Validation DoS Microsoft DirectPlay contains a flaw that may allow a remote denial of service. The issue is due to the implementation of the IDirectPlay4 API of Microsoft DirectPlay improperly validating packets. By sending a specially crafted packet, a remote attacker can crash the networked DirectPlay applications, resulting in a loss of availability.

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Windows DirectX IDirectPlay4 denial of service attempt RuleID : 23437 - Revision : 4 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows DirectX IDirectPlay4 denial of service attempt RuleID : 23436 - Revision : 4 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date	Description
2004-06-10	Name : It is possible to crash the remote DirectPlay service. File : smb_nt_ms04-016.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:45:00	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	5
CPE ID(s)	28
osvdb(s)	1
Openvas Exploit(s)	1
Snort® Rule(s)	2
Nessus® Exploit(s)	1

	Related
5	CVE-2004-0202
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0655s

Facebook rss twitter linkedin mail