Unchecked Buffer in Locator Service Could Lead to Code Execution: Jan 22

[eddie5659]

Hiya

The Microsoft Locator service is a name service that maps logical
names to network-specific names. It ships with Windows NT 4.0,
Windows 2000, and Windows XP. By default, the Locator service is
enabled only on Windows 2000 domain controllers and Windows NT 4.0
domain controllers; it is not enabled on Windows NT 4.0 workstations
or member servers, Windows 2000 workstations or member servers,
or Windows XP.

A security vulnerability results from an unchecked buffer in the
Locator service. By sending a specially malformed request to the
Locator service, an attacker could cause the Locator service to
fail, or to run code of the attacker's choice on the system.

Mitigating Factors:
====================
- The Locator service is not enabled by default on any affected
versions of Windows with the exception of Windows 2000 domain
controllers and Windows NT 4.0 domain controllers.

- A properly-configured firewall would block the calls to the
Locator service, which would protect an affected machine from
an Internet-based attack.


Maximum Severity Rating: Critical

Affected Software:

Microsoft Windows NT 4.0
Microsoft Windows NT 4.0, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP


Download locations for this patch

Windows NT 4.0:

All except Japanese NEC and Chinese - Hong Kong

Japanese NEC

Chinese - Hong Kong

Windows NT 4.0, Terminal Server Edition:


ALL

Windows 2000:

All except Japanese NEC

Japanese NEC

Windows XP:

32-bit Edition

64-bit Edition

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-001.asp

Regards

eddie