iDEFENSE Security Advisory 04.12.05: Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability

From: iDEFENSE Labs (
Date: 04/12/05

  • Next message: iDEFENSE Labs: "iDEFENSE Security Advisory 04.12.05: Microsoft MSHTA Script Execution Vulnerability"
    Date: Tue, 12 Apr 2005 14:43:38 -0400
    To: <>, <>, <>

    Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability

    iDEFENSE Security Advisory 04.12.05
    April 12, 2005


    The Win32 application-programming interface (API) offers a console
    windows feature that provides a means to implement command-line and
    other character-based user interfaces. The specific code for this
    feature within the Windows 2000, XP and 2003 operating systems resides
    in a core system process called CSRSS.EXE. This process is the main
    executable for the Microsoft Client/Server Runtime Server Subsystem. The
    process manages most graphical commands in Windows.


    Local exploitation of a stack-based buffer overflow vulnerability within
    various versions of Microsoft Corp.'s Windows operating system allows
    attackers to execute arbitrary code with SYSTEM privileges.

    Console windows are created and managed by code in the WINSRV.DLL file
    that resides in the CSRSS.EXE process. This file contains the
    server-side version of the 32-bit user and GDI routines (graphics
    engine). When a user selects the "Properties" item from the system menu
    of a console window, a data structure containing information about the
    console window is copied into the file-mapping object. The text of an
    assert in the checked build appears to indicate that this structure is
    called CONSOLE_STATE_INFO, which has the following structure:

        typedef struct _CONSOLE_STATE_INFO
          /* 0x00 */ DWORD cbSize;
          /* 0x04 */ COORD ScreenBufferSize;
          /* 0x08 */ COORD WindowSize;
          /* 0x0c */ POINT WindowPosition;
          /* 0x14 */ COORD FontSize;
          /* 0x18 */ DWORD FontFamily;
          /* 0x1c */ DWORD FontWeight;
          /* 0x20 */ WCHAR FaceName[32]; /* Buffer Overflow */
          /* 0x60 */ DWORD CursorSize;
          /* 0x64 */ BOOL FullScreen;
          /* 0x68 */ BOOL QuickEdit;
          /* 0x6c */ BOOL DefaultWindowPos;
          /* 0x70 */ BOOL InsertMode;
          /* 0x74 */ WORD ScreenColors;
          /* 0x76 */ WORD PopupColors;
          /* 0x78 */ BOOL HistoryNoDup;
          /* 0x7c */ DWORD HistoryBufferSize;
          /* 0x80 */ DWORD NumberOfHistoryBuffers;
          /* 0x84 */ COLORREF ColorTable[16];
          /* 0xc4 */ DWORD CodePage;
          /* 0xc8 */ DWORD hwnd;
          /* 0xcc */ WCHAR ConsoleTitle[2];

    The values contained within this struct are passed as a file-mapping
    object to code within WINSRV.DLL that does not properly validate the
    data. Passing a CONSOLE_STATE_INFO of all zero's can induce an integer
    divide-by-zero exception in the CSRSS process that will cause the
    process to terminate and the system to crash (blue screen) shortly
    thereafter. The CONSOLE_STATE_INFO data structure contains a null
    terminated string specifying the name of a font, FaceName[32]. This
    string is copied into a fixed sized stack buffer without any sanity
    checking via the wcscpy() function, as can be seen in the following
    assembly excerpt from WINSRV.DLL on Windows 2000 Service Pack 4 Checked

        0x5FFB39DF push [ebp+lpFaceName]
        0x5FFB39E2 lea eax, [ebp-54h]
        0x5FFB39E5 push eax
        0x5FFB39E6 call j_wcscpy

    By supplying a string longer than 32 bytes, an attacker can trigger the
    stack-based buffer overflow to gain control of the computer and
    eventually execute arbitrary code.


    Exploitation allows local unprivileged users to potentially execute
    arbitrary code on affected systems with SYSTEM privileges. An attacker
    with non-privileged access to a vulnerable system can leverage this
    vulnerability to fully compromise the underlying system. Exploitation of
    the described vulnerability requires that the attacker be able to create
    a console window. This attack may be used on public terminals to break
    imposed restrictions that otherwise prevent users from fully controlling
    the computer.


    iDEFENSE has confirmed the existence and exploitability of this
    vulnerability in Microsoft Windows 2000 SP4 and Microsoft Windows XP
    SP1a containing the following versions of CSRSS.EXE and WINSRV.DLL:

        * Windows 2000 SP4 CSRSS.EXE - 5.0.2195.6601
        * Windows 2000 SP4 WINSRV.DLL - 5.0.2195.6699
        * Windows XP SP1a CSRSS.EXE - 5.0.2195.6601
        * Windows XP SP1a WINSRV.DLL - 5.0.2195.6699

    iDEFENSE has confirmed the existence of this vulnerability as a local
    denial of service (blue screen) on Windows XP SP2 and Windows 2003. It
    is believed that code execution may also be possible on these platforms,
    though more difficult, as both platforms employ buffer overflow
    exploitation prevention methods.


    Restrict console access on public terminals where security is a concern.
    This can be accomplished by creating the following registry key:


    Add a DWORD named DisableCMD with the value "1" to disable command
    prompt and batch files or the value "2" to disable command prompt but
    allow batch files.


    This vulnerability is addressed in Microsoft Security Bulletin MS05-018
    available at:


    The Common Vulnerabilities and Exposures (CVE) project has assigned the
    names CAN-2005-0551 to these issues. This is a candidate for inclusion
    in the CVE list (, which standardizes names for
    security problems.


    01/04/2005 Initial vendor notification
    01/04/2005 Initial vendor response
    04/12/2005 Coordinated public disclosure


    David Fritz is credited with this discovery.

    Get paid for vulnerability research

    Free tools, research and upcoming events


    Copyright (c) 2005 iDEFENSE, Inc.

    Permission is granted for the redistribution of this alert
    electronically. It may not be edited in any way without the express
    written consent of iDEFENSE. If you wish to reprint the whole or any
    part of this alert in any other medium other than electronically, please
    email for permission.

    Disclaimer: The information in the advisory is believed to be accurate
    at the time of publishing based on currently available information. Use
    of the information constitutes acceptance for use in an AS IS condition.

    There are no warranties with regard to this information. Neither the
    author nor the publisher accepts any liability for any direct, indirect,
    or consequential loss or damage arising from use of, or reliance on,
    this information.

  • Next message: iDEFENSE Labs: "iDEFENSE Security Advisory 04.12.05: Microsoft MSHTA Script Execution Vulnerability"