Microsoft Windows XP/2003/Vista memory corruption 0day

Dear full-disclosure@xxxxxxxxxxxxxxxxx,

Since it's already wide spread on the public forums and exploit is
published on multiple sites and there is no way to stop it, I think
it's time to alert lists about this.

On the one of Russian forums:
http://www.kuban.ru/forum_new/forum2/files/19124.html
message was published by NULL about vulnerability in Windows on
processing MessageBox() with MB_SERVICE_NOTIFICATION flag and
message/caption beggining with \??\. Vulnerability seems to be memory
corruption in kernel and causes system crash or hang after few
attempts. It seems to happen because message is logged to event log
and may point to some problem with event logs processing.

Vulnerability details and code may be found here:
http://www.security.nnov.ru/Gnews944.html

There is potential remote exploitation vector if some service uses
user-supplied input for MessageBox() function. Messenger service is
not vulnerable in this way, because it prepends user-supplied input
with additional string.

I contacted Microsoft on this issue on December, 16.

--
http://www.security.nnov.ru
/\_/\
{ , . } |\
+--oQQo->{ ^ }<-----+ \
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
|/

Relevant Pages

  • [Full-disclosure] Microsoft Windows XP/2003/Vista memory corruption 0day
    ... Since it's already wide spread on the public forums and exploit is ... message was published by NULL about vulnerability in Windows on ... user-supplied input for MessageBoxfunction. ... Messenger service is ...
    (Full-Disclosure)
  • [NT] Buffer Overrun in Messenger Service Could Allow Code Execution (MS03-043)
    ... A security vulnerability exists in the Messenger Service that could allow ... * Microsoft Windows NT Workstation 4.0, ... Internet Connection Firewall (only available on XP and Windows Server ...
    (Securiteam)
  • Re: Unwanted Pop Up Ads
    ... > I said that disabling a service don't make a system MORE vulnerable. ... UNLESS you have applications in need of that port. ... Although disabling the messenger service does not make the system "more ... a warning sign of the vulnerability. ...
    (microsoft.public.security)
  • Re: False positive?
    ... Windows Messenger is very susceptible to buffer overflow problems. ... "Microsoft Windows Messenger Service contains a vulnerability that can ...
    (alt.comp.anti-virus)
  • Re: Need help on Microsoft pop ups
    ... > Scroll down and find the Messenger service, select it, right click it ... (Don't just stop receiving the symptom that you are vulnerable, ... the vulnerability.) ...
    (microsoft.public.windowsxp.newusers)