[NT] Additional Details Released on MS Windows XP Redirector Buffer Overflow Vulnerability
From: support@securiteam.com
Date: 03/29/03
- Previous message: support@securiteam.com: "[UNIX] Vulnerability in GNOME's Eye of Gnome"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: 29 Mar 2003 21:05:45 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
- - - - - - - - -
Additional Details Released on MS Windows XP Redirector Buffer Overflow
Vulnerability
------------------------------------------------------------------------
SUMMARY
As we reported in our previous article:
<http://www.securiteam.com/windowsntfocus/5WP0O1P9FA.html> Flaw in RPC
Endpoint Mapper Could Allow Denial of Service Attacks, a flaw has been
discovered in Windows XP. The following will try to provide additional
information.
NSFOCUS Security Team has found a buffer overflow vulnerability in
Microsoft Windows XP Redirector. Exploiting the vulnerability local
attackers could crash the system or gain local system privilege by
carefully crafted code.
DETAILS
Vulnerable systems:
* Microsoft Windows XP
* Microsoft Windows XP SP1
The Windows Redirector is used to access files, whether local or remote.
It is used to access network shares by net use command.
A security vulnerability exists in the Windows Redirector on Windows XP.
An unchecked length in handling the received parameter information causes
a buffer overflow vulnerability. Exploiting the vulnerability a
non-privileged user could cause system blue screen and reboot. If the code
was carefully crafted, attackers could execute arbitrary command in system
privilege. At present, no remote exploitation method has been found.
Only Windows XP is vulnerable to the issue. Windows NT 4.0, Windows NT 4.0
Terminal Server Edition, and Windows 2000 do not contain the vulnerable
code and are not affected by this vulnerability.
Exploit:
Enter the following command as a non-privileged user in the command line
window:
c:\> net use \\AAAA...AAA[about 1000-2000 'A' characters]\A
Windows XP will become blue screen or reboot immediately.
Note: Attackers have to be able to login interactively.
Workaround:
Prohibit untrusted user login to your system.
Vendor Status:
Microsoft has issued a Security Bulletin(MS03-005) and the related patch.
Detailed Microsoft Security Bulletin is available at:
<http://www.microsoft.com/technet/security/bulletin/ms03-005.asp>
http://www.microsoft.com/technet/security/bulletin/ms03-005.asp
Patches are available at:
* Microsoft Windows XP 32-bit Edition:
<http://microsoft.com/downloads/details.aspx?FamilyId=33DABD1F-505E-48ED-B9BD-CDAC0F8A2BC1> http://microsoft.com/downloads/details.aspx?FamilyId=33DABD1F-505E-48ED-B9BD-CDAC0F8A2BC1
* Microsoft Windows XP 64-bit Edition:
<http://microsoft.com/downloads/details.aspx?FamilyId=A2258F4E-9A69-4537-9469-0DDEB4BB76F8> http://microsoft.com/downloads/details.aspx?FamilyId=A2258F4E-9A69-4537-9469-0DDEB4BB76F8
ADDITIONAL INFORMATION
The information has been provided by <mailto:security@nsfocus.com>
NSFOCUS Security Team.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[UNIX] Vulnerability in GNOME's Eye of Gnome"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
