Microsoft Windows Media Services Can Be Crashed By Remote Users
|
|
SecurityTracker Alert ID: 1009359 |
|
SecurityTracker URL: http://securitytracker.com/id/1009359
|
|
CVE Reference:
CAN-2003-0905
(Links to External Site)
|
Date: Mar 9 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 4.1
|
Description:
A vulnerability was reported in Windows Media Services in the processing of certain TCP/IP connections. A remote user can cause the service to crash. A restart is required to return to normal operations.
It is reported that a remote user can send a specially crafted sequence of TCP/IP packets to the target Windows Media Station Service or Windows Media Monitor Service to cause the target service to stop responding. New requests will not be serviced and subsequent items in a playlist will not be served.
Systems that are configured to offer streaming media over unicast only are not affected, the report said. Also, systems that administer the Windows Media Services servers directly via the console or through a Terminal Services session are not affected.
Ports 7007 and 7778 are vulnerable on affected systems.
Microsoft reports that the Windows Media Services component is not installed by default.
Microsoft credits Qualys with reporting this issue.
|
Impact:
A remote user can cause the Windows Media Station Service or the Windows Media Monitor Service to crash. A restart is required to return to normal operations.
|
Solution:
Microsoft has issued the following fix:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7F4C067C-5D34-48FB-A9FA-C2200243D4D2&displaylang=en
This fix will be included in Windows 2000 SP5.
In some cases, this update does not require a reboot. See the vendor's advisory for caveats and also for some workarounds:
http://www.microsoft.com/technet/security/bulletin/ms04-008.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-008.mspx (Links to External Site)
|
Cause:
Exception handling error, State error
|
Underlying OS:
Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 09 Mar 2004 13:46:02 -0500
Subject: MS04-008
|
www.microsoft.com/technet/security/bulletin/ms04-008.mspx
Microsoft Security Bulletin MS04-008
Vulnerability in Windows Media Services Could Allow a Denial of Service (832359)
Issued: March 9, 2004
Affected Product: Windows Media Services 4.1 (included with Microsoft Windows 2000 Server)
Affected Operating Systems: Microsoft Windows 2000 Server SP2, Microsoft Windows 2000
Server SP3, Microsoft Windows 2000 Server SP4
Maximum Severity Rating: Moderate
CVE: CAN-2003-0905
Microsoft reports that Windows Media Services 9.0 Series (included with Microsoft Windows
Server 2003) and Windows Media Services 4.1 (available for download for Windows NT4
Server) are not affected.
A vulnerability was reported in Windows Media Services in the processing of certain TCP/IP
connections. A remote user can cause the service to crash. A restart is required to
return to normal operations.
It is reported that a remote user can send a specially crafted sequence of TCP/IP packets
to the target Windows Media Station Service or Windows Media Monitor Service to cause the
target service to stop responding. New requests will not be serviced and subsequent items
in a playlist will not be served.
Systems that are configured offer streaming media over unicast only are not affected, the
report said. Also, systems that administer the Windows Media Services servers directly
via the console or through a Terminal Services session are not affected.
Ports 7007 and 7778 are vulnerable on affected systems.
Microsoft reports that the Windows Media Services component is not installed by default.
Microsoft credits Qualys with reporting this issue.
Microsoft has issued the following fix:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7F4C067C-5D34-48FB-A9FA-C2200243D4D2&displaylang=en
This fix will be included in Windows 2000 SP5.
In some cases, this update does not require a reboot. See the vendor's advisory for
caveats and also for some workarounds:
http://www.microsoft.com/technet/security/bulletin/ms04-008.mspx
|
|
