Loading vulnerability…
CVE-2003-0533 is a stack-based buffer overflow in Active Directory service logging functions within the Microsoft Windows Local Security Authority Subsystem Service (LSASS). Insufficient bounds checking in vsprintf() calls in DsRolepLogPrintRoutine() allows excessive attacker-controlled input received through the LSASS DCE/RPC interface to overflow a stack buffer when debug logs are written. DsRolerUpgradeDownlevelServer() can invoke log initialization directly, bypassing an impersonation-related obstacle to exploitation on Windows 2000 and Windows XP. Successful exploitation permits arbitrary code execution with system-level privileges. The vulnerability was exploited by Sasser and other worms.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a single Metasploit module (Ruby file) that exploits the MS04-011 vulnerability (CVE-2003-0533) in the Microsoft LSASS service on Windows 2000 and Windows XP systems. The exploit leverages a stack buffer overflow in the DsRolerUpgradeDownlevelServer function, accessed via DCERPC over SMB (ports 445 or 139) using the \lsarpc named pipe. The module supports automatic and manual targeting for Windows 2000 and XP (English versions), and allows the user to specify a custom payload (e.g., reverse shell, Meterpreter). The exploit requires network access to the target's SMB service and valid credentials or guest access. If successful, it provides SYSTEM-level code execution on the target. The code is mature, weaponized, and part of the Metasploit framework, making it highly customizable and operationally ready.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stack-based buffer overflow in LSASRV.DLL results from insufficient bounds checking in vsprintf() calls within the DsRolepLogPrintRoutine() Active Directory logging function. Malformed requests through the LSASS DCE/RPC endpoint can trigger the overflow, including through the LSARPC named pipe over TCP ports 139 and 445. Anonymous remote exploitation is possible on Windows 2000 and XP, potentially allowing full system compromise. The content describes more restricted local exploitation on Windows Server 2003 and Windows XP 64-Bit Edition 2003. Sasser exploits this vulnerability in the wild. The separately discussed Sasser FTP-server overflow exploited by Dabber is a different vulnerability.
A critical buffer overflow in Windows LSASS (Local Security Authority Subsystem Service) that enables remote code execution; exploited by the Sasser worm to spread without user interaction.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.