Microsoft Riched Buffer Overflow Vulnerability

Bugtraq ID:	807
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 17 1999 12:00AM
Updated:	Nov 17 1999 12:00AM
Credit:	Posted to Bugtraq on November 17, 1999 by Pauli Ojanpera <[email protected]>.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 95 SR2 Microsoft Windows 95
Not Vulnerable:	Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server

Microsoft Riched Buffer Overflow Vulnerability

Riched20.dll and Riched32.dll, which Windows uses to parse Rich Text Forrmat files, have an unchecked buffer which allows arbitrary code to be executed. The code can be put into an .rtf file and emailed to the victim. Then if the victim opens the document, the code will be run at the same privilege level as the user.

NOTE: It has been reported on the Bugtraq mailing list that the patch provided by Microsoft does not completely fix the problem. A .rtf file with 1000 characters (instead of the original 32) will still crash the application reading the .rtf file.

Microsoft Riched Buffer Overflow Vulnerability

Solution:
Fixes available:


Microsoft Windows NT Enterprise Server 4.0

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows 95 SR2

• Microsoft Q249973
  http://www.microsoft.com/windows95/downloads/contents/WUCritical/rtfco ntrol/Default.asp

Microsoft Windows NT Terminal Server 4.0

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP6a

• Microsoft Q299444
  Post-Windows NT 4.0 Service Pack 6a Security Rollup.
  http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299444


• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP3

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP5

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP4

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP2

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP5

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP4

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Terminal Server 4.0 SP2

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows 98SE

• Microsoft Q249973
  http://www.microsoft.com/windows98/downloads/contents/WUCritical/rtfco ntrol/Default.asp

Microsoft Windows NT Terminal Server 4.0 SP4

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP6a

• Microsoft Q299444
  Post-Windows NT 4.0 Service Pack 6a Security Rollup.
  http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299444


• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP1

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows 98

• Microsoft Q249973
  http://www.microsoft.com/windows98/downloads/contents/WUCritical/rtfco ntrol/Default.asp

Microsoft Windows NT Terminal Server 4.0 SP1

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP2

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP3

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Terminal Server 4.0 SP3

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP6

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP1

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP6

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Terminal Server 4.0 SP6

• Microsoft Q317636
  Windows NT Server 4.0, Terminal Server Edition, Security Rollup Package
  http://www.microsoft.com/ntserver/terminalserver/downloads/critical/q3 17636/default.asp


• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP3

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Enterprise Server 4.0 SP6a

• Microsoft Q299444
  Post-Windows NT 4.0 Service Pack 6a Security Rollup.
  http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299444


• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP6

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP5

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Server 4.0 SP2

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Terminal Server 4.0 SP5

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows NT Workstation 4.0 SP1

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511

Microsoft Windows 95

• Microsoft Q249973
  http://www.microsoft.com/windows95/downloads/contents/WUCritical/rtfco ntrol/Default.asp

Microsoft Windows NT Server 4.0 SP4

• Microsoft Q249973
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17510


• Microsoft Q249973
  Microsoft NT 4 Alpha Architecture
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17511