Technical intelligence and weaponization dossier for CVE-2004-0280. Documented exploitation across 2 active malware families totaling 432 analyzed telemetry samples.
| Vulnerability ID | CVE-2004-0280 |
|---|---|
| Common Name / Bulletin | Microsoft Windows LSASS Buffer Overflow (Sasser Worm) (MS04-011) |
| CWE Classification | CWE-119: Stack Overflow in LSASRV.DLL |
| Affected Software & Versions | Microsoft Windows 2000, XP, Server 2003 |
| Technical Root Cause | Stack-based buffer overflow in Local Security Authority Subsystem Service (LSASS) via the DsRolerUpgradeDownlevelServer RPC API over TCP port 445, triggering automatic network worm propagation without credentials. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| berbew | Infostealer | 407 | Trojan:Win32/Berbew (widely known in antivirus telemetry as Padodor) is a historic banking trojan and multi-purpose infostealer discovered in 2004 that pioneere... |
| sasser | Worm | 25 | Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in... |
Threat intelligence confirms the following adversaries weaponize CVE-2004-0280 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2004-0280 in enterprise networks:
Sudden endpoint restarts with Windows dialog citing LSASS termination with status code 1073741819 (0xC0000005) coupled with scanning spikes on TCP port 445.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →