PUBLISHED DATE: December 31, 2002CVE-2002-2401:
NT Virtual DOS Machine...

Description

NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.

Products

• Microsoft Windows 2000
• Microsoft Windows 2000 Service Pack 1
• Microsoft Windows 2000 Service Pack 2
• Microsoft Windows 2000 Service Pack 3
• Microsoft Windows 2000
• Microsoft Windows 2000 Japanese Server Edition
• Microsoft Windows 2000 Advanced Server Edition
• Microsoft Windows 2000 Datacenter Server Edition
• Microsoft Windows 2000 Professional Edition
• Microsoft Windows 2000 Server Edition
• Microsoft Windows 2000 Beta 3
• Microsoft windows 2000_gold
• Microsoft Windows 2000 Addvanced Server (Initial Release)
• Microsoft Windows 2000 Datacenter Server (Initial Release)
• Microsoft Windows 2000 Professional (Initial release)
• Microsoft Windows 2000 Server (Inital release)
• Microsoft windows 2000_rc1
• Microsoft windows 2000_rc2
• Microsoft windows 2000_sp1
• Microsoft Windows 2000 Service Pack 1 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 1 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 1 Professional Edition
• Microsoft Windows 2000 Service Pack 1 Server Edition
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Server SP1
• Microsoft windows 2000_sp2
• Microsoft Windows 2000 Service Pack 2 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 2 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 2 Professional Edition
• Microsoft Windows 2000 Service Pack 2 Server Edition
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Server SP2
• Microsoft windows 2000_sp3
• Microsoft Windows 2000 Service Pack 3 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 3 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 3 Professional Edition
• Microsoft Windows 2000 Service Pack 3 Server Edition
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Datacenter Server SP3
• Microsoft Windows 2000 Professional SP3
• Microsoft Windows 2000 Server SP3
• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows 2000 Service Pack 4 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 4 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 4 Professional Edition
• Microsoft Windows 2000 Service Pack 4 Server Edition
• Microsoft Windows 2000 Service Pack 4 French
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Microsoft windows 2000_beta3
• Microsoft Windows NT 4.0
• Microsoft Windows NT 4.0 Workstation
• Microsoft Windows NT 4.0 Embedded Edition x64
• Microsoft Windows NT 4.0 Embedded Edition x86
• Microsoft Windows NT 4.0 Enterprise Edition x64
• Microsoft Windows NT 4.0 Enterprise Edition x86
• Microsoft Windows NT 4.0 Server Edition x64
• Microsoft Windows NT 4.0 Server Edition x86
• Microsoft Windows NT 4.0 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Workstation Edition x64
• Microsoft Windows NT 4.0 Workstation Edition x86
• Microsoft Windows 4.0 gold
• Microsoft Windows 4.0 gold embedded
• Microsoft Windows 4.0 gold enterprise
• Microsoft Windows 4.0 gold server
• Microsoft Windows NT 4.0 Terminal Server Edition (Initial release)
• Microsoft Windows 4.0 gold workstation
• Microsoft Windows 4.0 sp1
• Microsoft Windows NT 4.0 Service Pack 1 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Workstation Edition x86
• Microsoft Windows 4.0 sp1 embedded
• Microsoft Windows 4.0 sp1 enterprise
• Microsoft Windows 4.0 sp1 server
• Microsoft Windows NT Terminal Server 4.0 SP1
• Microsoft Windows NT 4.0 Service Pack 1 Terminal Server
• Microsoft Windows 4.0 sp1 workstation
• Microsoft Windows 4.0 sp2
• Microsoft Windows NT 4.0 Service Pack 2 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Workstation Edition x86
• Microsoft Windows 4.0 sp2 embedded
• Microsoft Windows 4.0 sp2 enterprise
• Microsoft Windows 4.0 sp2 server
• Microsoft Windows NT Terminal Server 4.0 SP2
• Microsoft Windows NT 4.0 Service Pack 2 Terminal Server
• Microsoft Windows 4.0 sp2 workstation
• Microsoft Windows 4.0 sp3
• Microsoft Windows NT 4.0 Service Pack 3 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Workstation Edition x86
• Microsoft Windows 4.0 sp3 embedded
• Microsoft Windows 4.0 sp3 enterprise
• Microsoft Windows 4.0 sp3 server
• Microsoft Windows NT Terminal Server 4.0 SP3
• Microsoft Windows NT 4.0 Service Pack 3 Terminal Server
• Microsoft Windows 4.0 sp3 workstation
• Microsoft Windows 4.0 sp4
• Microsoft Windows NT 4.0 Service Pack 4 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Workstation Edition x86
• Microsoft Windows 4.0 sp4 embedded
• Microsoft Windows 4.0 sp4 enterprise
• Microsoft Windows 4.0 sp4 server
• Microsoft Windows NT Terminal Server 4.0 SP4
• Microsoft Windows NT 4.0 Service Pack 4 Terminal Server
• Microsoft Windows 4.0 sp4 workstation
• Microsoft Windows 4.0 sp5
• Microsoft Windows NT 4.0 Service Pack 5 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Workstation Edition x86
• Microsoft Windows 4.0 sp5 embedded
• Microsoft Windows 4.0 sp5 enterprise
• Microsoft Windows 4.0 sp5 server
• Microsoft Windows NT Terminal Server 4.0 SP5
• Microsoft Windows NT 4.0 Service Pack 5 Terminal Server
• Microsoft Windows 4.0 sp5 workstation
• Microsoft Windows 4.0 sp6
• Microsoft Windows NT 4.0 Service Pack 6 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Workstation Edition x86
• Microsoft Windows 4.0 sp6 embedded
• Microsoft Windows 4.0 sp6 enterprise
• Microsoft Windows 4.0 sp6 server
• Microsoft Windows NT Terminal Server 4.0 SP6
• Microsoft Windows NT 4.0 Service Pack 6 Terminal Server
• Microsoft Windows 4.0 sp6 workstation
• Microsoft Windows 4.0 sp6a
• Microsoft Windows NT 4.0 Service Pack 6a Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Workstation Edition x86
• Microsoft Windows 4.0 sp6a embedded
• Microsoft Windows 4.0 sp6a enterprise
• Microsoft Windows 4.0 sp6a server
• Microsoft Windows NT Terminal Server 4.0 SP6a
• Microsoft Windows 4.0 sp6a workstation
• Microsoft Windows NT 4.0 Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Embedded Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Enterprise Edition Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Server Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Service Roll-up Terminal Server
• Microsoft Windows NT 4.0 Workstation Post Service Pack 6a Security Rollup
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• Microsoft Windows XP SP1 Home
• Microsoft Windows XP SP1 Professional
• Microsoft Windows XP (gold) Home Edition
• Microsoft Windows XP Service Pack 1 Home Edition
• Microsoft Windows XP Service Pack 2 Home Edition
• Microsoft Windows XP Service Pack 3 Home Edition

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2002-2401, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2002-2401 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2002-2401