Jean-Baptiste Marchand

A stack-based buffer overflow issue in the Plug and Play service allows remote attackers to execute arbitrary code via a crafted packet. Local users can also gain privileges by using a malicious application. This issue has been exploited by the Zotob worm.

Name of the Vulnerable Software and Affected Versions: Windows NT 4.0 Windows 2000 before URP1 for Windows 2000 SP4 Description: The issue allows remote attackers to list Windows services via `svcctl` or read event logs via `eventlog` due to improper prevention of NULL sessions from accessing certain alternate named pipes. Recommendations: For Windows NT 4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Windows 2000 before URP1 for Windows 2000 SP4, apply the URP1 update for Windows 2000 SP4 to resolve the issue.

The issue allows remote attackers to obtain sensitive information, such as users who are accessing resources, via an anonymous logon using a named pipe. This is due to improper authentication in the Server service (srvsvc.dll).