Microsoft ≫ Windows 2000

The installation for Windows 2000 does not activate the Administrator password until the system has rebooted, which allows remote attackers to connect to the ADMIN$ share without a password until the reboot occurs.

A Windows NT system does not clear the system page file during shutdown, which might allow sensitive information to be recorded.

When an administrator in Windows NT or Windows 2000 changes a user policy, the policy is not properly updated if the local ntconfig.pol is not writable by the user, which could allow local users to bypass restrictions that would otherwise be enforced...

NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.

Buffer overflow in Microsoft Rich Text Format (RTF) reader allows attackers to cause a denial of service via a malformed control word.

DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes.

Buffer overflow in Microsoft Phone Dialer (dialer.exe), via a malformed dialer entry in the dialer.ini file.

Denial of service in Windows NT Local Security Authority (LSA) through a malformed LSA request.

Denial of service in various Windows systems via malformed, fragmented IGMP packets.

An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header.