INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | A vulnerability exists because the ListBox control and the ComboBox control both call a function, which is located in the User32.dll file, that contains a buffer overrun. The function does not correctly validate the parameters that are sent to it. The controls can be made to run arbitrary code in the security context of the program that contains the control. |
| SOFTWARE: | MS Windows NT Workstation 4.0, Service Pack 6a MS Windows NT Server 4.0, Service Pack 6a MS Windows NT Server 4.0, Terminal Server Edition, Service 6 MS Windows 2000, Service Pack 2 MS Windows 2000, Service Pack 3, Service Pack 4 MS Windows XP Gold, Service Pack 1 MS Windows XP 64-bit Edition MS Windows XP 64-bit Edition Version 2003 MS Windows Server 2003 MS Windows Server 2003 64-bit Edition |
| DAMAGE: | A local attacker who has the ability to log onto a system interactively could run a program that could send a specially-crafted Windows message to any applications that have implemented the ListBox or the ComboBox controls, causing the application to take any action an attacker specified. This could give an attacker complete control over the system by using Utility Manager in Windows 2000 which runs with Administrator privileges. |
| SOLUTION: | Apply appropriate patches or implement workarounds. |
| VULNERABILITY ASSESSMENT: |
The risk is MEDIUM. An attacker with a user account could elevate their privileges to the Administrator level. |
| LINKS: | |
| CIAC BULLETIN: | http://www.ciac.org/ciac/bulletins/o-009.shtml |
| ORIGINAL BULLETIN: | http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-045.asp |
| CVE/CAN: | http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2003-0659 |
| ADDITIONAL LINKS: | CERT Advisory CA-2003-27 |
| http://www.cert.org/advisories/CA-2003-27.html | |
REVISION HISTORY:
10/17/03 - added link to CERT Advisory CA-2003-27.
10/30/03 - Microsoft released a revised security patch for Windows XP,
to address the problem described in their Knowledge Base Article
#830846 where installation of the previous patch may stop
responding (hang). The revised patch contains version 5.4.1.0 of
Update.exe. Version 5.4.1.0 or later versions of Update.exe no
longer require the Debug Programs user right.
11/04/03 - Microsoft has revised MS03-045 with a Patch Replacement. This
Patch also replaces the patch provided by MS02-071 [CIAC N-027].
11/06/03 - Microsoft has revised MS03-045 Technical Details Section with
information point to a new Knowledge Base Article 831739.
[***** Start Microsoft Security Bulletin MS03-045 *****]
Buffer Overrun in the ListBox and in the ComboBox Control Could Allow Code Execution (824141)
Issued: October 15, 2003
Updated: November 5, 2003
Version Number: 3.2
See all Windows bulletins released October, 2003
Summary
Who Should Read This Document: Customers using Microsoft® Windows®
Impact of Vulnerability: Local Elevation of Privilege
Maximum Severity Rating: Important
Recommendation: Customers should install this security patch at the earliest opportunity
Patch Replacement: MS02-071
Caveats: None
Tested Software and Patch Download Locations:
Affected Software:
Voice: +1 866-941-2472 (7 x 24)
E-mail: doecirc@doecirc.energy.gov
World Wide Web: http://www.doecirc.energy.gov/