RETIRED: Microsoft Windows CMD.EXE Buffer Overflow Vulnerability

Bugtraq ID:	20652
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 20 2006 12:00AM
Updated:	Oct 24 2006 10:18PM
Credit:	Luís Alberto Cortes Zavala is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Windows XP Professional SP2 Microsoft Windows XP Home SP2
Not Vulnerable:

RETIRED: Microsoft Windows CMD.EXE Buffer Overflow Vulnerability

Microsoft Windows is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Arbitrary code execution may be possible, but this has not been confirmed.

This issue affects Microsoft Windows XP SP2.

Note: Further analysis reveals that this is not a vulnerability; this BID is now retired.

RETIRED: Microsoft Windows CMD.EXE Buffer Overflow Vulnerability

The following proof-of-concept is available:

Copy paste the following lin cmd.exe:

%COMSPEC% /K "dir

\\?\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

RETIRED: Microsoft Windows CMD.EXE Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Note: Further analysis reveals that this is not a vulnerability; this BID is now retired.

RETIRED: Microsoft Windows CMD.EXE Buffer Overflow Vulnerability

References:

• Vendor Home Page (Microsoft)