Microsoft Windows Print Spooler Service Buffer Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1014638 |
|
SecurityTracker URL: http://securitytracker.com/id/1014638
|
|
CVE Reference:
CVE-2005-1984
(Links to External Site)
|
Updated: Jun 8 2008
|
Original Entry Date: Aug 9 2005
|
Impact:
Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2000 SP4 and XP SP2 and prior service packs, 2003
|
Description:
A vulnerability was reported in Microsoft Windows Print Spooler service. A remote user can execute arbitrary code on the target system.
A buffer overflow vulnerability exists in 'Spoolsv.exe'. A remote user can send a specially crafted packet to the target service to trigger the buffer overflow and execute arbitrary code on the target system.
On Windows XP SP2 and Windows Server 2003, Microsoft indicated that a remote user can cause denial of service conditions, but not execute code.
On Windows XP Service Pack 2 and Windows Server 2003, the remote user must be authenticated to exploit this flaw.
The default configuration of Windows 2000 and Windows XP SP1 are vulnerable.
The vendor credits Kostya Kortchinsky from CERT RENATER with reporting this vulnerability.
|
Impact:
A remote user can execute arbitrary code on the target system with System level privileges or cause the target system to crash.
|
Solution:
The vendor has issued the following fixes:
Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?familyid=3DD3B530-7F43-4C18-8298-6E8797431A5D
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=EF402946-1C3B-47E9-9D51-77D890DF8725
Microsoft Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?familyid=25469675-DF28-4889-8D13-25EFCD498388
Microsoft Windows Server 2003 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=F0AEC064-34A3-4EE4-9F15-BE1E3DD02BC7
A restart is not required.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-043.mspx (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 7 Aug 2005 22:10:57 -0400
Subject: http://www.microsoft.com/technet/security/Bulletin/MS05-043.mspx
|
http://www.microsoft.com/technet/security/Bulletin/MS05-043.mspx
|
|
