I know there is secunia and cve.mitre and ms kb database but I could not find a way to filter results only for operating system "windows xp" (or 2003 server, they share about the same code) with impact "arbitrary code execution" for which there is no workaround and no patch.

  • If you install an unpatched XP you can use any of the patched vulns. In what context are you looking for vulns?
    – RoraΖ
    Nov 24 '14 at 14:28
  • I want to be able to use this OS for as long as possible so I need to know how to reduce mitigation. Right now the only interaction with external data is via the web browser, for which I have already disabled remote fonts. Nov 24 '14 at 14:31
  • 2
  • 1
    @CostinGușă This is for your personal computer? Not a work one? And you want XP for its features? Maybe this is "too chatty," but what features are you talking about? I can't think of a single thing that would keep me on XP. It is just like saying "I don't want new software to work for me, and I want to have to constantly be worried about my OS being compromised."
    – Gray
    Nov 24 '14 at 16:05
  • 1
    this is my last comment because we are way offtopic by now. that answer is incorrect and does something else instead. also please read what blog "xpwasmyidea" has to say about features broken/removed by vista+ windows versions. there are LOTS OF POSTS on that blog, here's an example xpwasmyidea.blogspot.ro/2012/05/… Nov 24 '14 at 20:02

You will not find this elaborate data no matter where you search simply because there are a lot of unreported attacks against many operating systems. When dealing with XP, you are likely also dealing with the security issues with newer operating systems (Windows 7, Windows 8) not to mention software such as Adobe, Firefox, etc., that are no longer supporting Windows XP either.

By stating you are looking for "code execution" in Windows XP, you're forgetting about the amount of software that will never be updated for XP. Flash, Firefox, IE, Office, and this list goes on and on. It's akin to playing Russian Roulette with 3 or more bullets in the chamber.

Because you're still going to do whatever you choose to do, I suggest you focus on something like Tripwire, OSSEC or some other HIPS checksum mechanism to make sure nothing new is introduced on the system. You might be able to find (archive.org or something) a legacy copy of Black Ice Defender which can be configured to alert on the fly at in and outbound connection attempts versus relying on the standard Windows firewall.

As for your initial question, you won't find a source that will tell you ALL code execution exploits because you need to worry not only about Windows, but about the software it is running.

  • I have mentioned known unpatched vulnerabilities right in the title! What this means is that for each known vulnerability there is a published microsoft kb article and an associated patch and/or workaround. Definitely I am taking care on my own about other third party software. The questios is ONLY about the native operating system version - windows xp! Nov 24 '14 at 20:58
  • Your comment literally says that known unpatched vulnerabilities have associated patches. So I'm not sure what kind of answer you're looking for. What you're asking is slightly unreasonable. Microsoft has stopped documenting XP vulnerabilities. No master list exists, I'm sorry to say.
    – RoraΖ
    Nov 25 '14 at 3:07
  • Raz I think you're misunderstanding my comment. At no point in time do I believe known unpatched vulns have patches. But for what it's worth, there are technologies (IBM XGS virtual patching) that can aide when no patches are available.
    – munkeyoto
    Nov 25 '14 at 13:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.