BID:8090

Microsoft Windows 2000 ShellExecute() Buffer Overflow Vulnerability

Info

Microsoft Windows 2000 ShellExecute() Buffer Overflow Vulnerability

Bugtraq ID:	8090
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 03 2003 12:00AM
Updated:	Jul 03 2003 12:00AM
Credit:	Discovery is credited to Yuu Arai <[email protected]> and Hisayuki Shinmachi.
Vulnerable:	Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:	Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4

Discussion

Microsoft Windows 2000 ShellExecute() Buffer Overflow Vulnerability

The Windows 2000 ShellExecute() API is prone to a buffer overflow. When an unusually long string is passed to the third parameter, a buffer is overrun. This may result in a denial of service or potential code execution.

This issue was reportedly fixed in Windows 2000 Service Pack 4, however, the vendor has not confirmed this.

Exploit / POC

Microsoft Windows 2000 ShellExecute() Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Microsoft Windows 2000 ShellExecute() Buffer Overflow Vulnerability

Solution:
This vulnerability was reportedly addressed in Windows 2000 Service Pack 4, however, this has not been confirmed by Microsoft.

Microsoft Windows 2000 Professional