Microsoft Windows Server contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to an error in 'WINS.EXE' when handling replication packets. By sending a specially crafted WINS replication packet containing a modified memory pointer, a remote attacker could execute arbitrary code resulting in a loss of integrity.

Microsoft has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Disable the WINS service.

1. Control Panel -> "Add or Remove Programs"
2. "Components" -> "Networking Services" -> "Details".
3. Clear box next to "Windows Internet Naming Service (WINS)"

• SCIP VulDB ID: 1011
• Security Tracker: 1012341
• Bugtraq ID: 11763
• Related OSVDB ID: 12370
• Metasploit ID: 12378
• Secunia Advisory ID: 13328
• CERT VU: 145134
• ISS X-Force ID: 18259
• CVE ID: 2004-1080 (see also: NVD)
• Microsoft Knowledge Base Article: 870763 890710
• Milw0rm: 909
• Exploit Database: 909
• Keyword: aka "Association Context Vulnerability"
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0060.html
• Generic Exploit URL: http://beyonce.beyondsecurity.com/exploits/5EP020KEKW.html
  http://immunitysec.com
  http://metasploit.com/projects/Framework/exploits.html#wins_ms04_045
  http://www.saintcorporation.com/cgi-bin/exploit_info/wins_replication_service_pointer
• Other Advisory URL: http://www.immunitysec.com/downloads/instantanea.pdf
• Vendor URL: http://www.microsoft.com/
• Microsoft Security Bulletin: MS04-045
• CIAC Advisory: P-054

• Kostya Kortchinsky - CERT
• Nicolas Waisman - nicolas.waismanimmunitysec.com -