CVSS 10.0 CRITICAL Bulletin: MS04-011 Published: 2004-04-13

CVE-2004-0115: Microsoft Windows PCT / SSL Handshake Buffer Overflow

Technical intelligence and weaponization dossier for CVE-2004-0115. Documented exploitation across 5 active malware families totaling 3,685 analyzed telemetry samples.

Attributed Families

Sample Volume

3,685

CVSS Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2004-0115
Common Name / Bulletin	Microsoft Windows PCT / SSL Handshake Buffer Overflow (`MS04-011`)
CWE Classification	`CWE-119: Memory Buffer Bounds Violation in Schannel`
Affected Software & Versions	Microsoft Windows NT 4.0, 2000, XP, Server 2003
Technical Root Cause	Flaw in the Private Communications Transport (PCT) protocol implementation in Schannel during SSL handshakes, allowing unauthenticated remote attackers to execute arbitrary code via malformed client hello connection packets.
Associated ATT&CK Techniques	`T1210` — Associated ATT&CK Technique `T1190` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2004-0115

Empirical catalog telemetry verifies that the following 5 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

5 families

Malware Family	Category	Catalog Samples	Operational Profile
sdbot	Rat	`1,931`	SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first releas...
lamer	Worm	`894`	Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a ...
berbew	Infostealer	`407`	Trojan:Win32/Berbew (widely known in antivirus telemetry as Padodor) is a historic banking trojan and multi-purpose infostealer discovered in 2004 that pioneere...
ircbot	Rat	`348`	Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentra...
netsky	Worm	`105`	Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2004-0115 in enterprise intrusions and campaign toolkits:

Eastern European Cybercrime Groups — Attributed Threat Group / Campaign Operator
Global Cybercrime Syndicates — Attributed Threat Group / Campaign Operator
Sven Jaschan — Attributed Threat Group / Campaign Operator
Underground Cybercrime Groups — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2004-0115 in enterprise networks:

Anomalous TLS/SSL handshakes specifying cipher suite PCT 1.0 followed by immediate LSASS crash or unauthorized outbound network connections from lsass.exe.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Disable PCT 1.0 protocol via Windows Registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0; enforce TLS 1.2+ exclusively.

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)