SkipNavigation
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric



 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

 

Vulnerability Note VU#967668

Microsoft Windows ListBox and ComboBox controls vulnerable to buffer overflow when supplied crafted Windows message

Overview

There is a buffer overflow in a function called by the Microsoft Windows ListBox and ComboBox controls that could allow an attacker to execute arbitrary code with privileges of the process hosting the controls.

I. Description

Processes that run on Windows use messages in order to interact with the system and other processes. There is a buffer overflow in a function called by the Microsoft Windows ListBox and ComboBox controls. The function fails to properly validate the parameters that are sent from a crafted Windows Message. This could allow an attacker to execute arbitrary code with privileges of the process hosting the controls.

II. Impact

A local attacker can execute arbitrary code with privileges of the process hosting the controls, potentially gaining elevated privileges.

III. Solution

Apply a patch as described in Microsoft Security Bulletin MS03-045.

Systems Affected

VendorStatusDate Updated
Microsoft CorporationVulnerable16-Oct-2003

References


http://www.microsoft.com/technet/security/bulletin/MS03-045.asp
http://support.microsoft.com/default.aspx?kbid=824141
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winui/WinUI/WindowsUserInterface/Windowing/MessagesandMessageQueues/AboutMessagesandMessageQueues.asp
http://www.microsoft.com/enable/at/default.aspx

Credit

Thanks to Microsoft for reporting this vulnerability. Microsoft has credited Brett Moore for reporting this vulnerability.

This document was written by Damon Morda based on information contained in Microsoft Security Bulletin MS03-045.

Other Information

Date Public10/15/2003
Date First Published10/16/2003 02:50:27 PM
Date Last Updated10/22/2003
CERT Advisory 
CVE NameCAN-2003-0659
US-CERT Technical Alerts 
Metric14.43
Document Revision18

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2003 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader