Vulnerability Note VU#575892
Buffer overflow in Microsoft Messenger Service
There is a buffer overflow in the Microsoft Windows Messenger service that could allow an attacker to execute arbitrary code on most recent versions of Microsoft Windows.
There is a buffer overflow vulnerability in the Microsoft Windows Messenger service. This could allow an attacker to execute arbitrary code with System privileges. Microsoft recommends immediately disabling the Messenger service and evaluating the need for the patch. For more information, see Microsoft Security Bulletin MS03-043. This vulnerability affects virtually all recent versions of Windows with the exception of Microsoft Windows Millennium Edition. On Windows Server 2003, the Messenger service is disabled by default; however, if it is enabled the server is vulnerable to compromise.
An attacker can run arbitrary code with Local System privileges.
Disable the Windows messenger service and evaluate the need to apply the patch. to disable the Messenger service, follow these steps as provided by Microsoft:
You should carefully consider the impact of disabling the Messenger service.
As a general rule, and as a partial workaround to this problem, block ports 137 through 139 and UDP broadcast packets at your network perimeter and/or at the host level. This will limit the ability of external attackers to reach vulnerable systems.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||15 Oct 2003|
CVSS Metrics (Learn More)
Our thanks to Microsoft for the information contained in their bulletin. Microsoft has credited the Last Stage of Delirium Research Group for discovering the vulnerability.
This document was written by Shawn Hernan, based on information provided by Microsoft. .
- CVE IDs: CAN-2003-0717
- Date Public: 15 Oct 2003
- Date First Published: 15 Oct 2003
- Date Last Updated: 16 Oct 2003
- Severity Metric: 50.63
- Document Revision: 5
If you have feedback, comments, or additional information about this vulnerability, please send us email.