Alert: Microsoft Security Bulletin - MS03-001

• Previous message: David Fernández Madrid: "Access to open udp ports with Sygate Pro 5.0"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Wed, 22 Jan 2003 18:50:38 -0500
From: Russ <Russ.Cooper@RC.ON.CA>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

http://www.microsoft.com/technet/security/bulletin/MS03-001.asp

Unchecked Buffer in Locator Service Could Lead to Code Execution (810833)

Originally posted: January 22, 2003

Summary

Who should read this bulletin: Customers using Microsoft® Windows® NT 4.0, Windows 2000, or Windows XP.

Impact of vulnerability: Run code of the attacker's choice

Maximum Severity Rating: Critical

Recommendation: Customers running Windows NT 4.0 domain controllers or Windows 2000 domain controllers should apply the patch immediately. Customers should install the patch at the earliest opportunity on systems running Windows NT 4.0 (workstations and member servers), Windows 2000 (workstations and member servers), and Windows XP.

Affected Software:
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0, Terminal Server Edition
- Microsoft Windows 2000
- Microsoft Windows XP

End User Bulletin: An end user version of this bulletin is available at: http://www.microsoft.com/security/security_bulletins/ms03-001.asp

Technical description:

The Microsoft Locator service is a name service that maps logical names to network-specific names. It ships with Windows NT 4.0, Windows 2000, and Windows XP. By default, the Locator service is enabled only on Windows 2000 domain controllers and Windows NT 4.0 domain controllers; it is not enabled on Windows NT 4.0 workstations or member servers, Windows 2000 workstations or member servers, or Windows XP.

A security vulnerability results from an unchecked buffer in the Locator service. By sending a specially malformed request to the Locator service, an attacker could cause the Locator service to fail, or to run code of the attacker's choice on the system.

Mitigating factors:
- The Locator service is not enabled by default on any affected versions of Windows with the exception of Windows 2000 domain controllers and Windows NT 4.0 domain controllers.
- A properly-configured firewall would block the calls to the Locator service, which would protect an affected machine from an Internet-based attack.

Vulnerability identifier: CAN-2003-0003

This email is sent to NTBugtraq automatically as a service to my subscribers. Since its programmatically created, and since its been a long time since anyone paid actual money for my programming skills, it may or may not look that good...;-]

I can only hope that the information it does contain can be read well enough to serve its purpose.

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
TICSA - Anniversary Special - Limited Time

Become TICSA certified for just $221.25 US when you register before 3/31/03
with PROMO "TS0103" at www.2test.com. NO membership fees, certification
good for 2 years. Price for international delivery just $296.25 US, with
this offer. Offer cannot be combined with any other special and expires
3/31/03. Visit www.trusecure.com/ticsa for full details.

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

• Next message: Russ: "Alert: Microsoft Security Bulletin - MS03-002"
• Previous message: David Fernández Madrid: "Access to open udp ports with Sygate Pro 5.0"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]