Reported October 15, 2003,
by Microsoft.
VERSIONS AFFECTED
·
Windows 2003
·
Windows XP
·
Windows 2000
·
Windows NT
Server 4.0, Terminal Server Edition, Service Pack 6 (SP6a)
·
NT Server
4.0 SP6a
·
NT
Workstation 4.0 SP6a
DESCRIPTION
A vulnerability in the Microsoft Windows
Messenger Service can result in the remote execution of arbitrary code on the
vulnerable system under the Local System security context. This vulnerability is
a result of the Messenger Service improperly validating the length of a message
before passing it to the allocated buffer.
VENDOR RESPONSE
Microsoft has released security bulletin
MS03-043,
"Buffer Overrun in Messenger Service Could Allow Code Execution (828035)," which
addresses this vulnerability, and recommends that affected users immediately
apply the appropriate patch listed in the bulletin.
CREDIT
Discovered by
The Last Stage of Delirium Research Group.
Buffer Overrun in Windows Messenger Service
0 comments
Hide comments
