Alert: Microsoft Security Bulletin MS03-049 - Buffer Overrun in the Workstation Service Could Allow Code Execution (828749)

From: Russ (Russ.Cooper_at_RC.ON.CA)
Date: 11/11/03

  • Next message: Russ: "Alert: Microsoft Security Bulletin MS03-050 - Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527)" 
    Date:         Tue, 11 Nov 2003 16:27:05 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Microsoft Security Bulletin MS03-049:
    Buffer Overrun in the Workstation Service Could Allow Code Execution
    (828749)

    Bulletin URL:
    http://www.microsoft.com/technet/security/bulletin/MS03-049.asp

    Summary:
     Version Number: V1.0
     Revision Date: 11-11-2003
     Impact of Vulnerability: Remote Code Execution
     Maximum Severity Rating: Critical
     Patch(es) Replaced: None
     Caveats: None
     CVE Number(s): CAN-2003-0812

    Tested Software:
     Affected Software:
     * Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
    <http://www.ntbugtraq.com/link/2467FE46-D167-479C-9638-D4D79483F261.asp>
     * Microsoft Windows XP, Microsoft Windows XP Service Pack 1
    <http://www.ntbugtraq.com/link/F02DA309-4B0A-4438-A0B9-5B67414C3833.asp>
     * Microsoft Windows XP 64-Bit Edition
    <http://www.ntbugtraq.com/link/2BE95254-4C65-4CA5-80A5-55FDF5AA2296.asp>

     Software Not Affected:
     * Microsoft Windows NT Workstation 4.0, Service Pack 6a
     * Microsoft Windows NT Server 4.0, Service Pack 6a
     * Microsoft Windows NT Server 4.0, Terminal Server Edition, Service
    Pack 6
     * Microsoft Windows Millennium Edition
     * Microsoft Windows XP 64-Bit Edition Version 2003
     * Microsoft Windows Server 2003
     * Microsoft Windows Server 2003 64-Bit Edition

    Technical Description:

    A security vulnerability exists in the Workstation service that could
    allow remote code execution on an affected system. This vulnerability
    results because of an unchecked buffer in the Workstation service.

    If exploited, an attacker could gain System privileges on an affected
    system, or could cause the Workstation service to fail. An attacker
    could take any action on the system, including installing programs,
    viewing data, changing data, or deleting data, or creating new accounts
    with full privileges.

    This email is sent to NTBugtraq automagically as a service to my
    subscribers. (v2.0)

    Cheers,
    Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor 

    ----
NTBugtraq subscribers save $103.00 off the TICSA exam by using promo
code "NT1003" when registering to take the TICSA exam at www.2test.com.
Prove to your employer and peers that you have the knowledge and
abilities to be an active stakeholder in today's enterprise security.
Become TICSA certified www.trusecure.com/ticsa.  Promotion expires
12/31/03 and cannot be used in combination with other offers.
----
  • Next message: Russ: "Alert: Microsoft Security Bulletin MS03-050 - Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527)"

    Relevant Pages