From: Chris Robinson 

That sounds a bit dodgy (OK, very dodgy!) - and not too difficult to do by
the sounds of it - I wonder if anyone's servers got taken down by this
method? (even
if they did, there was nothing they could do about it for a month!).

Chris.

"Geo." wrote:

> that didn't take long... They only sat on this one for a month.
> Geo.
> -----------------
> The vulnerability can be triggered when an LDAP version 3 search request
> with more than 1000 "AND" statements is sent to the server,
resulting in a
> stack overflow and subsequent crash of the Lsaas.exe service.
> This in turn, will force a domain controller to stop responding, thus
> making possible a denial of service attack against it. The LDAP request
> does not need to be authenticated.
> The possibility of exploiting this vulnerability to execute arbitrary code
> on a vulnerable server has not been proved but is not discarded.

--- BBBS/NT v4.01 Flag-4