Microsoft Windows XP Shell Desktop.ini Buffer Overflow Vulnerability

Bugtraq ID:	8208
Class:	Boundary Condition Error
CVE:	CVE-2003-0351
Remote:	Yes
Local:	No
Published:	Jul 16 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	This vulnerability has been disclosed in a vendor bulletin.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition
Not Vulnerable:

Microsoft Windows XP Shell Desktop.ini Buffer Overflow Vulnerability

The Windows XP shell is prone to a buffer overflow condition that could allow arbitrary code execution in the security context of the current user. This is due to insufficient bounds checking in the code that reads and applies folder attributes from the Desktop.ini file for a particular folder.

Microsoft Windows XP Shell Desktop.ini Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows XP Shell Desktop.ini Buffer Overflow Vulnerability

Solution:
Microsoft has released fixes:


Microsoft Windows XP Professional SP1

• Microsoft WindowsXP-KB821557-x86-ENU.exe
  http://microsoft.com/downloads/details.aspx?FamilyId=27D02AF5-A2E1-4E2 5-9D16-502886161A35&displaylang=en

Microsoft Windows XP 64-bit Edition SP1

• Microsoft WindowsXP-KB821557-ia64-ENU.exe
  http://microsoft.com/downloads/details.aspx?FamilyId=4BA84E2B-49F9-441 6-8745-51F03503AB7D&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft WindowsXP-KB821557-x86-ENU.exe
  http://microsoft.com/downloads/details.aspx?FamilyId=27D02AF5-A2E1-4E2 5-9D16-502886161A35&displaylang=en