Vulnerability Note VU#130433
Microsoft License Logging Service buffer overflow
A vulnerability in a component of some server versions of Microsoft Windows could allow a remote attacker to execute code on a vulnerable system.
Microsoft's License Logging Service (LLS) assists in the management of licenses for some Microsoft server products. An error in the way that the LLS handles an unchecked buffer results in a vulnerability. An attacker with the ability to send a specially-crafted message to the LLS could exploit this vulnerability to execute code of their choosing or cause a denial of service. The specific nature of the message exploiting this vulnerability is not known.
Microsoft reports that, for some affected versions of Windows, only authenticated users or programs on the local network can establish a connection to the LLS and exploit the vulnerability. These versions are
For other affected versions of Windows, any unauthenticated remote attacker may be able to connect to the LLS and exploit the vulnerability. Microsoft also notes that LLS is disabled by default in Windows Server 2003 and will not be included in future versions of the Windows operating system.
On affected versions of Windows NT and Windows 2000 Server, a remote attacker may be able to execute arbitrary code with Local System privileges on a vulnerable system. Microsoft reports that exploitation of this vulnerability on Windows Server 2003 systems causes the License Logging Service to crash, resulting in a denial of service on that platform.
Apply a patch
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||08 Feb 2005|
CVSS Metrics (Learn More)
Thanks to Microsoft Security for reporting this vulnerability. Microsoft, in turn, thanks Kostya Kortchinsky of CERT RENATER for reporting this issue.
This document was written by Chad R Dougherty based upon information provided by Microsoft.
- CVE IDs: CAN-2005-0050
- Date Public: 08 Feb 2005
- Date First Published: 08 Feb 2005
- Date Last Updated: 08 Feb 2005
- Severity Metric: 10.69
- Document Revision: 6
If you have feedback, comments, or additional information about this vulnerability, please send us email.