search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Buffer overflow in Microsoft Messenger Service

Vulnerability Note VU#575892

Original Release Date: 2003-10-16 | Last Revised: 2003-10-16

Overview

There is a buffer overflow in the Microsoft Windows Messenger service that could allow an attacker to execute arbitrary code on most recent versions of Microsoft Windows.

Description

There is a buffer overflow vulnerability in the Microsoft Windows Messenger service. This could allow an attacker to execute arbitrary code with System privileges. Microsoft recommends immediately disabling the Messenger service and evaluating the need for the patch. For more information, see Microsoft Security Bulletin MS03-043. This vulnerability affects virtually all recent versions of Windows with the exception of Microsoft Windows Millennium Edition. On Windows Server 2003, the Messenger service is disabled by default; however, if it is enabled the server is vulnerable to compromise.

Impact

An attacker can run arbitrary code with Local System privileges.

Solution

Disable the Windows messenger service and evaluate the need to apply the patch. to disable the Messenger service, follow these steps as provided by Microsoft:

    1. Click Start , and then click Control Panel (or point to Settings , and then click Control Panel ).
    2. Double-click Administrative Tools .
    3. Double-click Services .
    4. Double-click Messenger .
    5. In the Startup type list, click Disabled .
    6. Click Stop , and then click OK .

    Impact of Workaround: If the Messenger service is disabled, messages from the Alerter service (for example notifications from your backup software or Uninterruptible Power Supply) are not transmitted. If the Messenger service is disabled, any services that explicitly depend on the Messenger service do not start, and an error message is logged in the System event log.

    The image below illustrates this procedure on Microsoft Windows XP. It will appear different on different versions of Windows.



    You should carefully consider the impact of disabling the Messenger service.

    As a general rule, and as a partial workaround to this problem, block ports 137 through 139 and UDP broadcast packets at your network perimeter and/or at the host level. This will limit the ability of external attackers to reach vulnerable systems.

    Vendor Information

    575892
     
    Affected   Unknown   Unaffected

    Microsoft Corporation

    Updated:  October 15, 2003

    Status

      Vulnerable

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    The vendor has not provided us with any further information regarding this vulnerability.

    Addendum

    See Microsoft Security Bulletin MS03-043.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base N/A N/A
    Temporal N/A N/A
    Environmental N/A

    References

    Acknowledgements

    Our thanks to Microsoft for the information contained in their bulletin. Microsoft has credited the Last Stage of Delirium Research Group for discovering the vulnerability.

    This document was written by Shawn Hernan, based on information provided by Microsoft.

    Other Information

    CVE IDs: CVE-2003-0717
    Severity Metric: 50.63
    Date Public: 2003-10-15
    Date First Published: 2003-10-16
    Date Last Updated: 2003-10-16 04:06 UTC
    Document Revision: 5

    Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.