Arbitrary Code Execution in Microsoft Windows

Reported October 12, 2004, by Microsoft

VERSIONS AFFECTED

Windows Server 2003 Windows XP Service Pack 1 (SP1) and earlier Windows 2000 Windows NT Server 4.0 Windows 98 and Windows 98 Second Edition (Win98SE)

DESCRIPTION
Four new vulnerabilities have been discovered in various versions of Windows that result in the arbitrary execution of code on the vulnerable system. These vulnerabilities consist of

Window Management vulnerability Virtual DOS Machine (VDM) vulnerability Graphics Rendering Engine vulnerability Windows kernel vulnerability

VENDOR RESPONSE
Microsoft has released bulletin MS04-032, "Security Update for Microsoft Windows (840987)," to address these vulnerabilities and recommends that affected users apply the appropriate patch listed in the bulletin.

CREDIT
Discovered by Brett Moore, eEye Digital Security, Patrick Porlan, and hlt.