CVE-2004-0574

published 2004-11-03

CVE-2004-0574: The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and…

Priority P2 62 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
microsoft	exchange_server	—	—
microsoft	exchange_server	—	—
microsoft	windows_nt	—	—
microsoft	windows_server_2003	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 119↗

command xpat From 1-9 <pattern>↗

command group control.newgroup↗

• → Detect oversized XPAT command arguments on NNTP port 119; the PoC uses a pattern of 1946 'C' characters followed by a space and 10 'X' characters, totalling well beyond normal XPAT argument length, indicative of heap overflow attempt. ↗
• → Monitor NNTP (port 119) traffic for XPAT commands with abnormally long pattern arguments (e.g., >1000 bytes), which may indicate exploitation of the unchecked buffer / heap overflow in the NNTP XPAT handler. ↗
• → The exploit targets the newsgroup 'control.newgroup'; monitor for NNTP GROUP commands selecting this or other control.* newsgroups prior to a large XPAT command as a precursor pattern. ↗
• → The vulnerability is triggered via XPAT patterns with improper length validation leading to off-by-one and heap-based buffer overflows; alert on XPAT commands exceeding safe length thresholds on NNTP services. ↗

• · The PoC hardcodes the target as localhost (127.0.0.1); in real-world exploitation the target host would vary. Detection should not rely on a specific source IP. ↗
• · This PoC is described as a Denial of Service / proof-of-concept only (MS04-036); actual remote code execution exploits may use different payload sizes or patterns beyond the 1946+10 byte pattern shown. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787