MS03-024: Buffer Overrun; Data Corruption

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- - -----------------------------------------------------------------

Title: Buffer Overrun in Windows Could Lead to Data

Corruption (817606)

Date: 09 July 2003

Software:

- Microsoft Windows NT Server 4.0

- Microsoft Windows NT Server 4.0, Terminal Server Edition

- Microsoft Windows 2000

- Windows XP Professional

Impact: Allow an attacker to execute code of their choice

Max Risk: Important

Bulletin: MS03-024

Microsoft encourages customers to review the Security Bulletins

at: http://www.microsoft.com/technet/security/.../bulletin/MS03-

024.asp

http://www.microsoft.com/security/security...ns/ms03-024.asp

- - -----------------------------------------------------------------

Issue:

======

Server Message Block (SMB) is the Internet Standard protocol that

Windows uses to share files, printers, serial ports, and to

communicate between computers using named pipes and mail slots.

In a networked environment, servers make file systems and

resources available to clients. Clients make SMB requests for

resources, and servers make SMB responses in what's described as

a client server request-response protocol.

A flaw exists in the way that the server validates the parameters

of an SMB packet. When a client system sends an SMB packet to the

server system, it includes specific parameters that provide the

server with a set of "instructions." In this case, the server is

not properly validating the buffer length established by the

packet. If the client specifies a buffer length that is less than

what is needed, it can cause the buffer to be overrun.

By sending a specially crafted SMB packet request, an attacker

could cause a buffer overrun to occur. If exploited, this could

lead to data corruption, system failure, or-in the worst case-

it could allow an attacker to run the code of their choice.

An attacker would need a valid user account and would need to

be authenticated by the server to exploit this flaw.

Mitigating Factors:

====================

- Windows Server 2003 is not affected by this vulnerability.

- By default, it is not possible to exploit this flaw

anonymously. The attacker would have to be authenticated by the

server prior to attempting to send a SMB packet to it.

- Blocking port 139/445 at the firewall will prevent the

possibility of an attack from the Internet.

Risk Rating:

============

- Important

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read

the Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-024.asp

http://www.microsoft.com/security/security...ns/ms03-024.asp

for information on obtaining this patch.

Acknowledgment:

===============

- Microsoft thanks Jeremy Allison and Andrew Tridgell, Samba

Team for reporting this issue to us and working with us to

protect customers.

- - -----------------------------------------------------------------

Edited July 9, 2003 by xStainDx

[OPaul]

What about XP Home? It only says Pro yet under "Not Affected Software" Home is not listed.

[LonghornXP2006]

What about XP Home? It only says Pro yet under "Not Affected Software" Home is not listed.

mabye home is not effected

[LonghornXP2006]

What about XP Home? It only says Pro yet under "Not Affected Software" Home is not listed.

it does not hurt to install it