[VulnWatch] NSFOCUS SA2003-01: Microsoft Windows XP Redirector Local Buffer Overflow Vulnerability

From: NSFCOSU Security Team (security@nsfocus.com)
Date: 03/27/03

  • Next message: Gregory Le Bras | Security Corporation: "[VulnWatch] [SCSA-012] Multiple vulnerabilities in Sambar Server"
    From: NSFCOSU Security Team <security@nsfocus.com>
    To: bugtraq@securityfocus.com
    Date: Thu, 27 Mar 2003 15:36:55 +0800
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    NSFOCUS Security Advisory(SA2003-01)

    Topic: Microsoft Windows XP Redirector Local Buffer Overflow Vulnerability

    Release Date: 2003-3-27

    CVE CAN ID: CAN-2003-0004

    Affected system:
    ===================

    - - Microsoft Windows XP
    - - Microsoft Windows XP SP1

    Summary:
    =========

    NSFOCUS Security Team has found a buffer overflow vulnerability in Microsoft
    Windows XP Redirector. Exploiting the vulnerability local attackers
    could crash the system or gain local system privilege by carefully crafted
    code.

    Description:
    ============

    The Windows Redirector is used to access files, whether local or remote.It
    is used to access network shares by net use command.

    A security vulnerability exists in the Windows Redirector on Windows XP.An
    unchecked length in handling the received parameter information causes a
    buffer overflow vulnerability. Exploiting the vulnerability a non-privileged
    user could cause system blue screen and reboot. If the code was carefully
    crafted, attackers could execute arbitrary command in system privilege. At
    present no remote exploitation method has been found.

    Only Windows XP is vulnerable to the issue. Windows NT 4.0, Windows NT 4.0
    Terminal Server Edition, and Windows 2000 do not contain the vulnerable code
    and are not affected by this vulnerability.

    Exploit:
    ==========

    Enter the following command as a non-privileged user in the command line
    window:

    c:\> net use \\AAAA...AAA[about 1000-2000 'A' characters]\A

    Windows XP will become blue screen or reboot immediately.

    Note: Attackers have to be able to login interactively.

    Workaround:
    =============

     Prohibit untrusted user login to your system.

    Vendor Status:
    ==============

    Microsoft has issued a Security Bulletin(MS03-005) and the related patch.

    Detailed Microsoft Security Bulletin is available at:

    http://www.microsoft.com/technet/security/bulletin/ms03-005.asp

    Patches are available at:

    . Microsoft Windows XP 32-bit Edition:
    http://microsoft.com/downloads/details.aspx?FamilyId=33DABD1F-505E-48ED-B9BD-CDAC0F8A2BC1

    . Microsoft Windows XP 64-bit Edition:
    http://microsoft.com/downloads/details.aspx?FamilyId=A2258F4E-9A69-4537-9469-0DDEB4BB76F8

    Additional Information:
    ========================

    The Common Vulnerabilities and Exposures (CVE) project has assigned the
    name CAN-2003-0004 to this issue. This is a candidate for inclusion in the
    CVE list (http://cve.mitre.org), which standardizes names for security
    problems. Candidates may change significantly before they become official
    CVE entries.

    DISCLAIMS:
    ==========
    THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
    OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED,
    EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENTSHALL NSFOCUS
    BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
    INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
    EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
    DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
    ADVISORY IS NOT MODIFIED IN ANY WAY.

    Copyright 1999-2003 NSFOCUS. All Rights Reserved. Terms of use.

    NSFOCUS Security Team <security@nsfocus.com>
    NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
    (http://www.nsfocus.com)

    PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
    Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQE+gqok1794d8am9toRApqxAJwMtZqaVys339PPHkRjUcvmLkh5fgCePqE0
    q704B7gafnFoyZW+4w3auwI=
    =wAjk
    -----END PGP SIGNATURE-----


  • Next message: Gregory Le Bras | Security Corporation: "[VulnWatch] [SCSA-012] Multiple vulnerabilities in Sambar Server"