BID:8084

Microsoft Windows IMAADPCM cbDestLength Buffer Overrun Vulnerability

Info

Microsoft Windows IMAADPCM cbDestLength Buffer Overrun Vulnerability

Bugtraq ID:	8084
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2003 12:00AM
Updated:	Jun 26 2003 12:00AM
Credit:	This issue was announced by Microsoft.
Vulnerable:	Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:	Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4

Discussion

Microsoft Windows IMAADPCM cbDestLength Buffer Overrun Vulnerability

The Microsoft Windows 2000 IMAADPCM audio compression/decompression driver is prone to a buffer overrun. This is due to insufficient bounds checking of data supplied by an external source to the cbDestLength element. It has been reported that this issue could be exploited by remote attackers to execute malicious instructions on a vulnerable system.

This issue was announced by Microsoft with the release of Windows 2000 SP4 and has been addressed in this service pack.

Exploit / POC

Microsoft Windows IMAADPCM cbDestLength Buffer Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Microsoft Windows IMAADPCM cbDestLength Buffer Overrun Vulnerability

Solution:
This issue has been addressed in Windows 2000 SP4. Administrators should upgrade to SP4 at the earliest possible convenience. Windows 2000 Datacenter users should upgrade only if it is in conjunction with their OEM.

Please see the documentation provided by Microsoft for instructions on how to upgrade and to determine the applicability of upgrading to SP4.

Microsoft Windows 2000 Professional