Buffer Overrun in Microsoft Universal Naming Convention Provider Service

Reported April 4, 2002, by NSFocus.

VERSIONS AFFECTED

 

  • Windows XP

  • Windows 2000

  • Windows NT 4.0

 

DESCRIPTION

A buffer overrun vulnerability exists in the Multiple Universal Naming Convention Provider (MUP) service that lets an attacker use the Local System security context to execute code on a vulnerable system. This vulnerability stems from the fact that the MUP service doesn't check inputs correctly before sending the second copy of the buffer contents to the redirector.

 

VENDOR RESPONSE

The vendor, Microsoft, has released security bulletin MS02-017, which addresses this vulnerability. The company recommends that affected users apply the appropriate patch listed at this URL.

 

CREDIT
Discovered by NSFocus.

TAGS: Security
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish