(Vendor Issues Fix) Microsoft WINS Memory Overwrite Lets Remote Users Execute Arbitary Code
|
|
SecurityTracker Alert ID: 1012516
|
|
SecurityTracker URL: http://securitytracker.com/id?1012516
|
|
CVE Reference: CAN-2004-1080
(Links to External Site)
|
|
OSVDB Reference: 12159
(Links to External Site)
|
Date: Dec 14 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): NT 4.0 SP6a, 2000 SP4, 2003; and prior service packs
|
Description: A vulnerability was reported in Microsoft Windows in 'wins.exe'. A remote user can execute arbitrary code on the target system.
Nicolas Waisman from Immunity reported that a remote user can send a specially crafted WINS packet to the target server on TCP port
42 to modify a memory pointer and write arbitrary contents to arbitrary memory locations. A remote user can execute arbitrary code
on the target system.
The original advisory is available at:
http://www.immunitysec.com/downloads/instantanea.pdf
Microsoft
later reported that Windows 2000 SP3 and SP4, Windows XP SP1 and SP2, Windows XP 64-Bit Edition SP1, Windows XP 64-Bit Edition Version
2003, Windows 98, Windows 98 Second Edition (SE), and Windows Millennium Edition (ME) are not affected.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has released the following fixes.
Microsoft Windows NT Server 4.0 Service Pack 6a:
http://www.microsoft.com/downloads/details.aspx?FamilyId=38E9DB8C-5C43-
4E9A-9DC9-97C2686A45F1
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D7AB3F6F-26F
E-4AE8-A07A-481D772D03A6
Microsoft Windows 2000 Server Service Pack 3 and Microsoft Windows 2000 Server Service Pack 4:
http://www.microsoft.com/downloads/details.a
spx?FamilyId=40146B52-5546-489E-857E-01FE1EF709B2
Microsoft Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=10836F38-A38B-47D5-B87B-18
D8E26EEFAA
Microsoft Windows Server 2003 64-Bit Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=06CF9E85-C66D-4A7D-B2EB-99DE9423B60F
A
restart is required in most cases.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-045.mspx (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Windows (NT), Windows (2000), Windows (2003)
|
OS Comments: Tested on Windows 2000 SP2, SP3, SP4
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 14 Dec 2004 14:21:55 -0500
Subject: http://www.microsoft.com/technet/security/bulletin/ms04-045.mspx
|
http://www.microsoft.com/technet/security/bulletin/ms04-045.mspx
|
|
