Vulnerabilidades

Bonk variation of teardrop IP fragmentation denial of service.

Buffer overflow in War FTP allows remote execution of commands.

Memory leak in Simple Network Management Protocol (SNMP) agent (snmp.exe) for Windows NT 4.0 before Service Pack 4 allows remote attackers to cause a denial of service (memory consumption) via a large number of SNMP packets with Object Identifiers (OIDs) that cannot be decoded.

A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.

Teardrop IP denial of service.

Land IP denial of service.

The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories.

Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment, which the TCP/IP stack incorrectly reassembles into a valid session.

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

Listening TCP ports are sequentially allocated, allowing spoofing attacks.

Denial of service in Windows NT DNS servers by flooding port 53 with too many characters.

Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service.

Windows NT 4.0 SP2 allows remote attackers to cause a denial of service (crash), possibly via malformed inputs or packets, such as those generated by a Linux smbmount command that was compiled on the Linux 2.0.29 kernel but executed on Linux 2.0.25.

Denial of service through Winpopup using large user names.

A version of finger is running that exposes valid user information to any entity on the network.

Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT.

A Windows NT system's user audit policy does not log an event success or failure, e.g. for Logon and Logoff, File and Object Access, Use of User Rights, User and Group Management, Security Policy Changes, Restart, Shutdown, and System, and Process Tracking.

A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness.

A Windows NT account policy has inappropriate, security-critical settings for lockout, e.g. lockout duration, lockout after bad logon attempts, etc.

A Windows NT system's file audit policy does not log an event success or failure for security-critical files or directories.

Windows NT RSHSVC program allows remote users to execute arbitrary commands.

The registry in Windows NT can be accessed remotely by users who are not administrators.

A Windows NT 4.0 user can gain administrative rights by forcing NtOpenProcessToken to succeed regardless of the user's permissions, aka GetAdmin.

A Windows NT local user or administrator account has a default, null, blank, or missing password.

A Windows NT user has inappropriate rights or privileges, e.g. Act as System, Add Workstation, Backup, Change System Time, Create Pagefile, Create Permanent Object, Create Token Name, Debug, Generate Security Audit, Increase Priority, Increase Quota, Load Driver, Lock Memory, Profile Single Process, Remote Shutdown,…