Unrated severityNVD Advisory· Published Jun 4, 2007· Updated Jun 16, 2026

CVE-2007-2999

Description

Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account names.

Affected products

Microsoft/Windows Server 20034 versions
cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*
- (no CPE)

Patches

Vulnerability mechanics

References

secunia.com/advisories/25457nvdVendor Advisory
osvdb.org/36138nvd
www.notsosecure.com/folder2/2007/05/27/logon-time-restrictions-in-a-domain-in-windows-server-2003-allows-username-enumeration/nvd
www.securityfocus.com/bid/24248nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000