Microsoft Windows NT File Management Function Denial Of Service Vulnerability
BID:8259
Info
Microsoft Windows NT File Management Function Denial Of Service Vulnerability
| Bugtraq ID: | 8259 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0525 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 23 2003 12:00AM |
| Updated: | Jul 11 2009 10:56PM |
| Credit: | Discovery is credited to Matt Miller and Jeremy Rauch of @stake. |
| Vulnerable: |
Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 alpha Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 |
| Not Vulnerable: | |
Discussion
Microsoft Windows NT File Management Function Denial Of Service Vulnerability
Microsoft Windows NT 4.0 is prone to a denial of service vulnerability within the GetCanonicalPath() function, which is part of ntdll.dll. Support for the function is not installed on Windows NT by default, but may pose remote attack vectors on systems that support the function and run applications that use the function without sufficient input validation of externally-supplied data.
The vulnerability is related to memory management and may potentially be exploited to execute arbitrary code on the system, though this has not been confirmed.
Microsoft Windows NT 4.0 is prone to a denial of service vulnerability within the GetCanonicalPath() function, which is part of ntdll.dll. Support for the function is not installed on Windows NT by default, but may pose remote attack vectors on systems that support the function and run applications that use the function without sufficient input validation of externally-supplied data.
The vulnerability is related to memory management and may potentially be exploited to execute arbitrary code on the system, though this has not been confirmed.
Exploit / POC
Microsoft Windows NT File Management Function Denial Of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Windows NT File Management Function Denial Of Service Vulnerability
Solution:
The vendor has released an updated patch to resolve the RRAS service issue. The updated fixes are linked below.
Microsoft has acknowledged reports that have indicated issues with the patch when applied to NT 4.0 systems that use RRAS (Routing and Remote Access Service). In particular, the RRAS service may fail when a patched system is rebooted. A temporary hotfix has been made available to address these problems and can be obtained by contacting Microsoft Product Support Services. The vendor has stated that updated patches to address these issues with systems that use RRAS are pending. More information is available in the revised version of MS03-029.
It has also been reported that the patch may cause similiar problems with the Web Proxy service for Microsoft Proxy Server. The vendor hotfix is also reported to address this problem with the patch.
Microsoft has released fixes for this issue:
Microsoft Windows NT Workstation 4.0 SP6a
Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows NT Enterprise Server 4.0 SP6a
Microsoft Windows NT Server 4.0 SP6a
Solution:
The vendor has released an updated patch to resolve the RRAS service issue. The updated fixes are linked below.
Microsoft has acknowledged reports that have indicated issues with the patch when applied to NT 4.0 systems that use RRAS (Routing and Remote Access Service). In particular, the RRAS service may fail when a patched system is rebooted. A temporary hotfix has been made available to address these problems and can be obtained by contacting Microsoft Product Support Services. The vendor has stated that updated patches to address these issues with systems that use RRAS are pending. More information is available in the revised version of MS03-029.
It has also been reported that the patch may cause similiar problems with the Web Proxy service for Microsoft Proxy Server. The vendor hotfix is also reported to address this problem with the patch.
Microsoft has released fixes for this issue:
Microsoft Windows NT Workstation 4.0 SP6a
-
Microsoft Q823803i.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylang=en
Microsoft Windows NT Terminal Server 4.0 SP6
-
Microsoft Q823803i.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=5C46460D-3887-4D5 F-B142-F505BB208797&displaylang=en -
Microsoft WindowsNT4Server-KB823803-x86-ENU.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylan
Microsoft Windows NT Enterprise Server 4.0 SP6a
-
Microsoft Q823803i.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylang=en -
Microsoft WindowsNT4Server-KB823803-x86-ENU.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylan
Microsoft Windows NT Server 4.0 SP6a
-
Microsoft Q823803i.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylang=en -
Microsoft WindowsNT4Server-KB823803-x86-ENU.EXE
http://microsoft.com/downloads/details.aspx?FamilyId=8FF8CA3E-D546-4FA F-851F-FFBE2490B901&displaylan
References
Microsoft Windows NT File Management Function Denial Of Service Vulnerability
References:
References:
- Microsoft Security Bulletin MS03-029 (Microsoft)
- MS03-029 / Q823803 breaks RAS? ("Adam D. Barratt"
- RE: Windows NT 4.0 with IBM JVM Denial of Service ("Angelidis, Fotis\(NSASOUDABAY\)"