OSVDB ID: 12378

Title: Microsoft Windows WINS Association Context Validation Remote Code Execution

Info

Disclosure
Dec 14, 2004

Discovery
Unknown

Dates

Exploit
Jan 02, 2005

Solution
Unknown

Description

 Microsoft Windows Server contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to an error in 'WINS.EXE' when handling replication packets. By sending a specially crafted WINS replication packet containing a modified memory pointer, a remote attacker could execute arbitrary code resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified

Solution

 Microsoft has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Disable the WINS service. 1. Control Panel -> "Add or Remove Programs" 2. "Components" -> "Networking Services" -> "Details". 3. Clear box next to "Windows Internet Naming Service (WINS)"

Products

Microsoft Corporation

Windows

 NT 4.0 Server SP6a
NT 4.0 Server SP6a Terminal Server Edition
2003 Server x64
2003 Server
2000 Server SP3
2000 Server SP4

References

Credit
  • Kostya Kortchinsky - CERT
  • Nicolas Waisman - nicolas.waismanimmunitysec.com -


Direct URL: http://osvdb.org/12378