CVE-2002-1256
Estado: ModificadaMedia (5)—
The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
- Puntuación base: 5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.41%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- NVD-CWE-Other
Referencias
- http://www.securityfocus.com/bid/6367
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10843
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277
- http://www.securityfocus.com/bid/6367
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10843
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277
JSON original (NVD)
Mostrar
{
"id": "CVE-2002-1256",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2002-12-23T05:00:00.000",
"references": [
{
"url": "http://www.securityfocus.com/bid/6367",
"source": "cve@mitre.org"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/10843",
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/6367",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/10843",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A277",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller."
},
{
"lang": "es",
"value": "La capacidad de firmado en el protocolo Bloque de Mensaje de Servidor (SMB) en Microsoft Windows XP y Windows 2000 permite a atacantes desactivar la configuración de firma digital en una sesión SMB y forzar que los datos se envien sin firmar, e insertar entonces datos en la sesión sin detección; por ejemplo modificando la información de política de grupo enviada desde un controlador de dominio."
}
],
"lastModified": "2026-06-16T21:59:00.847",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E545C63-FE9C-4CA1-AF0F-D999D84D2AFD"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "294EBA01-147B-4DA0-937E-ACBB655EDE53"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E8B7346-F2AA-434C-A048-7463EC1BB117"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE1A6107-DE00-4A1C-87FC-9E4015165B5B"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000_terminal_services:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D34EFE5-22B7-4E8D-B5B2-2423C37CFFA7"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8208AFC9-0EFC-4A90-AD5A-FD94F5542885"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D4168AE-D19E-482E-8F2B-3E798B2D84E7"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5E149E7-B748-44F6-BB55-68D5BF87AF41"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91D6D065-A28D-49DA-B7F4-38421FF86498"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC176BB0-1655-4BEA-A841-C4158167CC9B"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BF263CB-4239-4DB0-867C-9069ED02CAD7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}