Vulnerability record · CVE-2004-0120 · published 1 June 2004
CVE-2004-0120: Microsoft SSL library denial of service via malformed SSL messages
Microsoft · Windows 2000
The Microsoft SSL library shipped with Windows 2000, Windows XP and Windows Server 2003 fails to handle malformed SSL messages safely, allowing a remote attacker to crash or hang the affected service. Because the flaw sits in a core system library used by many SSL-enabled services, any reachable TLS/SSL endpoint on an unpatched host is a potential target.
Description
The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityCVSS 2.0 rates this 5.0 (medium) with availability-only impact, but the affected platforms are long out of support and EPSS is high, so unpatched legacy hosts still warrant attention.
What it is
The Microsoft SSL library shipped with Windows 2000, Windows XP and Windows Server 2003 fails to handle malformed SSL messages safely, allowing a remote attacker to crash or hang the affected service. Because the flaw sits in a core system library used by many SSL-enabled services, any reachable TLS/SSL endpoint on an unpatched host is a potential target.
Impact
An attacker can cause a denial of service, disrupting SSL-dependent services on the host. The record shows no confidentiality or integrity impact, so no data theft or code execution is indicated.
Attack surface
Reachable over the network (AV:N) with no authentication (Au:N) and low complexity (AC:L) by sending malformed SSL messages to a listening SSL service. No user interaction is required.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.51 (98.9th percentile), indicating substantial predicted exploitation activity. Reference tags include Patch and advisory links, but no public exploit tag is present.
What to do
- Apply Microsoft security bulletin MS04-011 (the vendor patch referenced in the record) to all affected Windows 2000, XP and Server 2003 systems.
- Retire or isolate end-of-life Windows 2000, XP and Server 2003 hosts that cannot be patched.
- Restrict network exposure of SSL/TLS listeners to trusted sources where the service does not need to be public.
- Monitor vendor and CERT/CC advisories for updated guidance on this library flaw.
Detection
- Alert on repeated TLS/SSL handshake failures or malformed-record errors from a single source against the same service.
- Monitor for unexpected termination or restart of SSL-dependent services (IIS, RDP, SMTP over TLS) on affected hosts.
- Correlate spikes in connection resets or service crashes with inbound traffic to SSL ports from untrusted networks.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0120 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0120), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
