- Joined
- Mar 19, 2001
- Messages
- 37,484
Hiya
The Microsoft Locator service is a name service that maps logical
names to network-specific names. It ships with Windows NT 4.0,
Windows 2000, and Windows XP. By default, the Locator service is
enabled only on Windows 2000 domain controllers and Windows NT 4.0
domain controllers; it is not enabled on Windows NT 4.0 workstations
or member servers, Windows 2000 workstations or member servers,
or Windows XP.
A security vulnerability results from an unchecked buffer in the
Locator service. By sending a specially malformed request to the
Locator service, an attacker could cause the Locator service to
fail, or to run code of the attacker's choice on the system.
Mitigating Factors:
====================
- The Locator service is not enabled by default on any affected
versions of Windows with the exception of Windows 2000 domain
controllers and Windows NT 4.0 domain controllers.
- A properly-configured firewall would block the calls to the
Locator service, which would protect an affected machine from
an Internet-based attack.
Maximum Severity Rating: Critical
Affected Software:
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP
Download locations for this patch
Windows NT 4.0:
All except Japanese NEC and Chinese - Hong Kong
Japanese NEC
Chinese - Hong Kong
Windows NT 4.0, Terminal Server Edition:
ALL
Windows 2000:
All except Japanese NEC
Japanese NEC
Windows XP:
32-bit Edition
64-bit Edition
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-001.asp
Regards
eddie
The Microsoft Locator service is a name service that maps logical
names to network-specific names. It ships with Windows NT 4.0,
Windows 2000, and Windows XP. By default, the Locator service is
enabled only on Windows 2000 domain controllers and Windows NT 4.0
domain controllers; it is not enabled on Windows NT 4.0 workstations
or member servers, Windows 2000 workstations or member servers,
or Windows XP.
A security vulnerability results from an unchecked buffer in the
Locator service. By sending a specially malformed request to the
Locator service, an attacker could cause the Locator service to
fail, or to run code of the attacker's choice on the system.
Mitigating Factors:
====================
- The Locator service is not enabled by default on any affected
versions of Windows with the exception of Windows 2000 domain
controllers and Windows NT 4.0 domain controllers.
- A properly-configured firewall would block the calls to the
Locator service, which would protect an affected machine from
an Internet-based attack.
Maximum Severity Rating: Critical
Affected Software:
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP
Download locations for this patch
Windows NT 4.0:
All except Japanese NEC and Chinese - Hong Kong
Japanese NEC
Chinese - Hong Kong
Windows NT 4.0, Terminal Server Edition:
ALL
Windows 2000:
All except Japanese NEC
Japanese NEC
Windows XP:
32-bit Edition
64-bit Edition
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-001.asp
Regards
eddie