[SNS Advisory No.65] Windows 2000 ShellExecute() API Let Applications to Cause Buffer Overflow

From: Secure Net Service(SNS) Security Advisory (snsadv_at_LAC.CO.JP)
Date: 07/03/03

  • Next message: Russ: "Re: Q329170 (MS02-070), Q327984 and slow logoffs" 
    Date:         Thu, 3 Jul 2003 10:46:10 +0900
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    ----------------------------------------------------------------------
    SNS Advisory No.65
    Windows 2000 ShellExecute() API Let Applications to Cause Buffer Overflow

    Problem first discovered: Thu, 5 Dec 2002
    Published: Thu, 03 Jul 2003
    Reference: http://www.lac.co.jp/security/intelligence/SNSAdvisory/65.html
    ----------------------------------------------------------------------

    Overview:
    ---------
      A buffer overflow vulnerability exists in the Windows 2000 API
      ShellExecute() function.

    Problem Description:
    -------------------
      Windows API ShellExecute() is a function to run an application
      associated with a specified file extension.

      The problem is triggered when the pointer to an unusually long string
      is set to the 3rd argument of the Windows 2000 API Shell Execute()
      API function.

      It has been confirmed that several applications containing web browser,
      MUA and text editor are vulnerable to this problem.

    Tested Version:
    ---------------
      SHELL32.DLL (Version 5.0.3502.6144)

    Solution:
    ---------
      This problem can be rectified by installing Windows 2000 Service Pack 4.
      http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

      Microsoft is considering public presentation of the further information
      about this problem.

    Discovered by:
    --------------
      Yuu Arai y.arai@lac.co.jp
      Hisayuki Shinmachi

    Acknowledgements:
    -----------------
    Thanks to:
      RimArts, Inc. Tomohiro Norimatsu
      Security Response Team of Microsoft Asia Limited

    Disclaimer:
    -----------
    The information contained in this advisory may be revised without prior
    notice and is provided as it is. Users shall take their own risk when
    taking any actions following reading this advisory. LAC Co., Ltd. shall
    take no responsibility for any problems, loss or damage caused by, or by
    the use of information provided here.

    This advisory can be found at the following URL:
    http://www.lac.co.jp/security/intelligence/SNSAdvisory/65.html

    ------------------------------------------------------------------
    Secure Net Service(SNS) Security Advisory <snsadv@lac.co.jp>
    Computer Security Laboratory, LAC http://www.lac.co.jp/security/

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!

    With a growth rate exceeding 110%, the TICSA security practitioner
    certification is one of the hottest IT credentials available. And now, for
    a limited time, you can save 33% off of the TICSA certification exam! To
    learn more about the TICSA certification, and to register as a TICSA
    candidate online, just go to

    http://www.trusecure.com/offer/s0100/

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

  • Next message: Russ: "Re: Q329170 (MS02-070), Q327984 and slow logoffs"

    Relevant Pages

    • [SNS Advisory No.65] Windows 2000 ShellExecute() API Let Applications to Cause Buffer Overflow
      ... Windows 2000 ShellExecute() API Let Applications to Cause Buffer Overflow ... The information contained in this advisory may be revised without prior ...
      (Bugtraq)
    • Re: newbe about API
      ... Emne: Re: newbe about API ... > I found all these API-CALL strings are finally compiled to ... more than that...and Windows simply takes this to an extreme that this ... DLL, when a weak point is found (which, with Microsoft, is something ...
      (alt.lang.asm)
    • Re: In the Shallow End
      ... When a document claims how an API is supposed to be used and then gives the user examples that actually work, ... Vague in your instance means you have no context to VMS or UNIX of that era. ... Windows offers lots of this stuff. ... That's why Apple had to dump a whole paradigm to plunge ahead and take the lead. ...
      (comp.sys.mac.advocacy)
    • Re: a pre-beginners question: what is the pros and cons of .net, compared to ++
      ... as the windows forms architecture wraps a number of activex ... and retains backwards compatibility with both COM and the classic Win32 api. ... C++ cannot inherently do video capture either, since you have to import COM. ... Outlook or Word or IM programs, each of which would run in managed code ...
      (microsoft.public.dotnet.general)
    • Re: Interpreting a BAS module
      ... unicode and ansi strings. ... applications make calls out to Windows to ask it to do something (e.g. ... you have to utilize an API that is designed to ... AddressOf is also used in subclassing. ...
      (microsoft.public.vb.general.discussion)