Vulnerability Note VU#130433

Microsoft License Logging Service buffer overflow

Overview

A vulnerability in a component of some server versions of Microsoft Windows could allow a remote attacker to execute code on a vulnerable system.

I. Description

Microsoft's License Logging Service (LLS) assists in the management of licenses for some Microsoft server products. An error in the way that the LLS handles an unchecked buffer results in a vulnerability. An attacker with the ability to send a specially-crafted message to the LLS could exploit this vulnerability to execute code of their choosing or cause a denial of service. The specific nature of the message exploiting this vulnerability is not known.

Microsoft reports that, for some affected versions of Windows, only authenticated users or programs on the local network can establish a connection to the LLS and exploit the vulnerability. These versions are

Windows 2000 Server Service Pack 4
Windows Server 2003
Windows Small Business Server 2003 and Small Business Server 2000 running on Windows 2000 Server Service Pack 4

For other affected versions of Windows, any unauthenticated remote attacker may be able to connect to the LLS and exploit the vulnerability. Microsoft also notes that LLS is disabled by default in Windows Server 2003 and will not be included in future versions of the Windows operating system.

II. Impact

On affected versions of Windows NT and Windows 2000 Server, a remote attacker may be able to execute arbitrary code with Local System privileges on a vulnerable system. Microsoft reports that exploitation of this vulnerability on Windows Server 2003 systems causes the License Logging Service to crash, resulting in a denial of service on that platform.

III. Solution

Apply a patch

Microsoft has published Microsoft Security Bulletin MS05-010 in response to this issue. Users are strongly encouraged to review this advisory and apply the patches it refers to.

Workarounds

Microsoft Security Bulletin MS05-010 also contains a number of workarounds for this issue. Users, particularly those who are affected but unable to apply the patches, are encouraged to implement these workarounds.

Systems Affected

Vendor	Status	Date Updated
Microsoft Corporation	Vulnerable	8-Feb-2005

References

http://www.microsoft.com/technet/security/bulletin/ms05-010.mspx

Credit

Thanks to Microsoft Security for reporting this vulnerability. Microsoft, in turn, thanks Kostya Kortchinsky of CERT RENATER for reporting this issue.

This document was written by Chad R Dougherty based upon information provided by Microsoft.

Other Information

Date Public	02/08/2005
Date First Published	02/08/2005 05:06:47 PM
Date Last Updated	02/08/2005
CERT Advisory
CVE Name	CAN-2005-0050
US-CERT Technical Alerts
Metric	10.69
Document Revision	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader