$ cve CVE-2003-0533 JSON

CVE-2003-0533 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 85.5% (pctl 100)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	85.49% — more likely to be exploited than 100% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-06-01
Last modified	2026-06-16

Affected (7)

Vendor	Product
microsoft	netmeeting
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows 98
microsoft	windows me
microsoft	windows nt
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft LSASS Service - DsRolerUpgradeDownlevelServer Overflow (MS04-011) (Metasploit)	2010-07-03
exploit-db	Microsoft Windows XP/2000 - 'Lsasrv.dll' Remote Universal (MS04-011)	2004-04-29
exploit-db	Microsoft Windows - 'Lsasrv.dll' RPC Remote Buffer Overflow (MS04-011)	2004-04-24

References

→ the Explorer · watch your stack · NVD