Buffer Overrun in Windows Messenger Service

Reported October 15, 2003, by Microsoft.




·         Windows 2003

·         Windows XP

·         Windows 2000

·         Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 (SP6a)

·         NT Server 4.0 SP6a

·         NT Workstation 4.0 SP6a




A vulnerability in the Microsoft Windows Messenger Service can result in the remote execution of arbitrary code on the vulnerable system under the Local System security context. This vulnerability is a result of the Messenger Service improperly validating the length of a message before passing it to the allocated buffer.




Microsoft has released security bulletin MS03-043, "Buffer Overrun in Messenger Service Could Allow Code Execution (828035)," which addresses this vulnerability, and recommends that affected users immediately apply the appropriate patch listed in the bulletin.




Discovered by The Last Stage of Delirium Research Group.

TAGS: Security
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.