Vulnerability record · CVE-2003-0605 · published 27 August 2003
CVE-2003-0605: Windows 2000 RPC DCOM NULL pointer DoS and local privilege escalation
Microsoft · Windows 2000
The RPC DCOM interface in Windows 2000 SP3 and SP4 mishandles certain messages to the __RemoteGetClassObject interface, passing a NULL pointer to the PerformScmStage function. This lets remote attackers crash the service and lets local attackers use the resulting DoS to hijack the epmapper pipe and gain privileges. It matters because a network-reachable crash can be chained locally into privilege escalation on an unpatched host.
Description
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe flaw is remotely reachable without authentication and can be chained to local privilege escalation, and EPSS is very high despite no KEV listing.
What it is
The RPC DCOM interface in Windows 2000 SP3 and SP4 mishandles certain messages to the __RemoteGetClassObject interface, passing a NULL pointer to the PerformScmStage function. This lets remote attackers crash the service and lets local attackers use the resulting DoS to hijack the epmapper pipe and gain privileges. It matters because a network-reachable crash can be chained locally into privilege escalation on an unpatched host.
Impact
A remote attacker can cause a denial of service by crashing the RPC DCOM service. A local attacker can leverage that crash to hijack the epmapper pipe and escalate privileges.
Attack surface
Reached over the network via the RPC DCOM interface with no authentication required (AV:N/AC:L/Au:N), per the CVSS vector. The privilege escalation path requires local access to the affected host.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.59 (99th percentile), indicating elevated predicted exploitation likelihood. Reference tags are limited to US Government Resource advisories and vendor/OVAL entries, with no exploit tags.
What to do
- Apply the Microsoft security update referenced in MS03-039 for Windows 2000 SP3 and SP4.
- Block or restrict TCP ports 135, 139, 445 and RPC endpoint mapper traffic at network boundaries where feasible.
- Disable or restrict the RPC DCOM service on hosts that do not require it.
- Retire or isolate Windows 2000 systems, which are past end of support and cannot receive current fixes.
- Monitor and limit local interactive access to reduce the privilege escalation path.
Detection
- Monitor for unexpected crashes or restarts of the RPC DCOM service on Windows 2000 hosts.
- Alert on anomalous RPC traffic to the __RemoteGetClassObject interface and epmapper pipe activity.
- Correlate a remote RPC crash event with subsequent local logon or privilege changes on the same host.
- Use the referenced OVAL definitions to scan for unpatched Windows 2000 SP3/SP4 systems.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0605 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0605), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
