Buffer Overflow in Windows Kernel Message Handling

Reported April 16, 2003, by Microsoft.

VERSIONS AFFECTED

·        Microsoft Windows XP

·        Microsoft Windows 2000

·        Microsoft Windows NT 4.0 Server, Terminal Services Edition

·        Microsoft Windows NT 4.0

DESCRIPTION

A new vulnerability exists in A new vulnerability exists in Windows XP, 2000 and NT 4.0 that could result in the execution of arbitrary code on the vulnerable system. This vulnerability is a result of flaw in the way that the Windows kernel passes error messages to a debugger. A potential attacker could exploit this vulnerability and take any action on the system including deleting data, adding accounts with administrative access, or reconfiguring the system. According to Microsoft, for this attack to be successful an attacker would need to be able to logon interactively to the system from either the console or through a terminal session.

VENDOR RESPONSE

The vendor,Microsoft, has released Security BulletinMS03-013 (Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493)) to address this vulnerability, and recommends that affected users immediately apply the patch mentioned in the bulletin.

CREDIT          

Discovered by Oded Horovitz ofEntercept Security Technologies.