Vulnerability Note VU#130433

Microsoft License Logging Service buffer overflow

Original Release date: 08 Feb 2005 | Last revised: 08 Feb 2005

Overview

A vulnerability in a component of some server versions of Microsoft Windows could allow a remote attacker to execute code on a vulnerable system.

Description

Microsoft's License Logging Service (LLS) assists in the management of licenses for some Microsoft server products. An error in the way that the LLS handles an unchecked buffer results in a vulnerability. An attacker with the ability to send a specially-crafted message to the LLS could exploit this vulnerability to execute code of their choosing or cause a denial of service. The specific nature of the message exploiting this vulnerability is not known.

Microsoft reports that, for some affected versions of Windows, only authenticated users or programs on the local network can establish a connection to the LLS and exploit the vulnerability. These versions are

  • Windows 2000 Server Service Pack 4
  • Windows Server 2003
  • Windows Small Business Server 2003 and Small Business Server 2000 running on Windows 2000 Server Service Pack 4

For other affected versions of Windows, any unauthenticated remote attacker may be able to connect to the LLS and exploit the vulnerability. Microsoft also notes that LLS is disabled by default in Windows Server 2003 and will not be included in future versions of the Windows operating system.

Impact

On affected versions of Windows NT and Windows 2000 Server, a remote attacker may be able to execute arbitrary code with Local System privileges on a vulnerable system. Microsoft reports that exploitation of this vulnerability on Windows Server 2003 systems causes the License Logging Service to crash, resulting in a denial of service on that platform.

Solution

Apply a patch

Microsoft has published Microsoft Security Bulletin MS05-010 in response to this issue. Users are strongly encouraged to review this advisory and apply the patches it refers to.

Workarounds


Microsoft Security Bulletin MS05-010 also contains a number of workarounds for this issue. Users, particularly those who are affected but unable to apply the patches, are encouraged to implement these workarounds.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected-08 Feb 2005
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Microsoft Security for reporting this vulnerability. Microsoft, in turn, thanks Kostya Kortchinsky of CERT RENATER for reporting this issue.

This document was written by Chad R Dougherty based upon information provided by Microsoft.

Other Information

  • CVE IDs: CAN-2005-0050
  • Date Public: 08 Feb 2005
  • Date First Published: 08 Feb 2005
  • Date Last Updated: 08 Feb 2005
  • Severity Metric: 10.69
  • Document Revision: 6

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.