Vulnerability in Microsoft Authenticode Verification Could Allow Remote Code Execution

Reported October 15, 2003, by Microsoft.

VERSIONS AFFECTED

·        Windows 2003

·        Windows XP

·        Windows 2000

·        Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 (SP6)

·        NT Server 4.0 SP6a

·        NT Workstation 4.0 SP6a

DESCRIPTION

A vulnerability in several Windows OS versions can result in the remote execution of arbitrary code on the vulnerable system under the security context of the logged-on user. This vulnerability is a result of a flaw in Authenticode that, under certain low-memory conditions, can permit the download and installation of an ActiveX control without presenting the user with an approval dialog box.

VENDOR RESPONSE

Microsoft has released security bulletin MS03-041, "Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)," which addresses this vulnerability, and recommends that affected users immediately apply the appropriate patch listed in the bulletin.

CREDIT

Discovered by Microsoft.