|
|
| |
Credit:
The information has been provided by zdi-disclosures@tippingpoint.com.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-09-053
|
| |
Vulnerable Systems:
* Microsoft Windows 2003 SP2
* Microsoft Windows 2000 SP4
The specific flaw exists within the WINS.exe process which provides name resolution services for NetBIOS networks. While parsing a push request the WINS service copies packet data to a static heap buffer while within a controlled loop. By providing a specially crafted request an attacker can overflow this heap buffer leading to arbitrary code execution under the SYSTEM context.
Patch Availability:
Microsoft has issued an update to correct this vulnerability. More details can be found at:
http://www.microsoft.com/technet/security/bulletin/MS09-039.mspx
CVE Information:
CVE-2009-1923
Disclosure Timeline:
2009-02-24 - Vulnerability reported to vendor
2009-08-11 - Coordinated public release of advisory
|
|
|
