A remote overflow exists in the Windows Workstation Service of Microsoft Windows. The 'WKSSVC.DLL' fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution with SYSTEM privileges resulting in a loss of integrity.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• Secunia Advisory ID: 10193
• Metasploit ID: 11461
• Milw0rm: 119 123 130
• Exploit Database: 119 123 130
• ISS X-Force ID: 13639
• CVE ID: 2003-0812 (see also: NVD)
• OVAL ID: 331 575
• SCIP VulDB ID: 383
• CERT VU: 567620
• Microsoft Knowledge Base Article: 828749
• Bugtraq ID: 9011
• CERT: CA-2003-28
• Other Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2003-11/0114.html
  http://research.eeye.com/html/advisories/published/AD20031111.html
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2003-11/0114.html
• Generic Exploit URL: http://immunitysec.com
• Generic Informational URL: http://www.eeye.com/html/Research/Advisories/AD20031111.html [ Link is 404 ]
• Vendor URL: http://www.microsoft.com/
• Microsoft Security Bulletin: MS03-049
• CIAC Advisory: o-022

• Yuji Ukai - eEye Digital Security