exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ms01-013

ms01-013
Posted Feb 27, 2001

Microsoft Security Advisory MS01-013 - The Windows 2000 event viewer snap-in has an unchecked buffer in a section of the code that displays the detailed view of event records. If the event viewer attempts to display an event record that contains specially malformed data in one of the fields, code of the attacker's choice can be made to run with the privileges of the user running the event viewer. Microsoft FAQ on this issue available here.

systems | windows
SHA-256 | fd428d11543b426f8a0c1f9971572740551089ba5b2c2d6b0713c7bb5424dbe0

ms01-013

Change Mirror Download
The following is a Security  Bulletin from the Microsoft Product Security
Notification Service.

Please do not reply to this message, as it was sent from an unattended
mailbox.
********************************

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title: Windows 2000 Event Viewer Contains Unchecked Buffer
Date: February 26, 2001
Software: Windows 2000
Impact: Run code of attacker's choice
Bulletin: MS01-013

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-013.asp.
- ----------------------------------------------------------------------

Issue:
======
The Windows 2000 event viewer snap-in has an unchecked buffer in a
section of the code that displays the detailed view of event records.
If the event viewer attempted to display an event record that
contained specially malformed data in one of the fields, either of
two outcomes would result. In the less serious case, the event viewer
would fail. In the more serious case, code of the attacker's choice
could be made to run via a buffer overrun.

By design, unprivileged processes can log events in the System and
Application logs, and interactively logged-on, unprivileged users can
view them. However, only privileged processes can log events in the
Security log, and only interactively logged-on administrators can
view them. If the vulnerability were exploited to run code of the
attacker's choice, the code would run in the security context of the
user who viewed the affected record.

Mitigating Factors:
====================
- Simply perusing the listing of events in a log would not allow
the vulnerability to be exploited. It could only be exploited
if the user opened an affected record to view the event details.
- Although the Event Viewer is generally thought of as an
administrative tool, there is no guarantee that the user who opens
a particular event record would be privileged. Unprivileged users
can read the System and Application logs. Although the Security
log can only be read by privileged users, only privileged
processes can write to it.
- To the best of our knowledge, it is not possible to manipulate
the normal auditing functions of any Windows 2000 service in order
to create an event record that would exploit this vulnerability.
Instead, a custom piece of code would need to be created and run
to create such a record.
- If firewalling and other appropriate precautions have been taken,
only authenticated users will have access to network machines and
be able to write event log records.

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms01-013.asp
for information on obtaining this patch.

Acknowledgment:
===============
- Blake Watts of Guardent (http://www.guardent.com)

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.



-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3

iQEVAwUBOprQmY0ZSRQxA/UrAQGGpgf/ZxvSC+9sp7ThlvyNkgNjyIG6QqieegtC
K/5VbqsA2JtvSOYFOVXUG/JJIsDhFCumXGt33RJX83mAMgqSDYCXmO+17UrXqr5w
HLNX4BNLyx/nlEATXVj3/fiz55XYCVNCXFgIlZ7xYP1PvfTKGfEsK8wkkmLlSZDo
fDFGCXcEFX8CCAhwnDiMPCfI7yXPll33e2Tad2Zd067zOGr+WXuLHC3x9blQL7WE
QjcSaxCeVawHA2UtoI7zEZvnynZrpfHCQK3iL/A73tOiArvATS4AjaSA3iqMGrYS
POGcgTPTaUeZUbdIxTa17cb7fiwjmntYZ/tIYuumIVeaLaqjPi7sxA==
=/a0Y
-----END PGP SIGNATURE-----

*******************************************************************
You have received this e-mail bulletin as a result of your registration
to the Microsoft Product Security Notification Service. You may
unsubscribe from this e-mail notification service at any time by sending
an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

For more information on the Microsoft Security Notification Service
please visit http://www.microsoft.com/technet/security/notify.asp. For
security-related information about Microsoft products, please visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close