6th Apr 2003 [SBWID-6107]
Microsoft Windows XP Redirector Local Buffer Overflow Vulnerability
Microsoft Windows XP
Microsoft Windows XP SP1
-----BEGIN PGP SIGNED MESSAGE-----
NSFOCUS Security Advisory(SA2003-01)
Topic: Microsoft Windows XP Redirector Local Buffer Overflow
Release Date: 2003-3-27
CVE CAN ID: CAN-2003-0004
- - Microsoft Windows XP
- - Microsoft Windows XP SP1
NSFOCUS Security Team has found a buffer overflow vulnerability in
Microsoft Windows XP Redirector. Exploiting the vulnerability local
attackers could crash the system or gain local system privilege by
carefully crafted code.
The Windows Redirector is used to access files, whether local or
remote.It is used to access network shares by net use command.
A security vulnerability exists in the Windows Redirector on Windows
XP.An unchecked length in handling the received parameter information
causes a buffer overflow vulnerability. Exploiting the vulnerability a
non-privileged user could cause system blue screen and reboot. If the
code was carefully crafted, attackers could execute arbitrary command
in system privilege. At present no remote exploitation method has been
Only Windows XP is vulnerable to the issue. Windows NT 4.0, Windows NT
4.0 Terminal Server Edition, and Windows 2000 do not contain the
vulnerable code and are not affected by this vulnerability.
Enter the following command as a non-privileged user in the command
c:\> net use \\AAAA...AAA[about 1000-2000 'A' characters]\A
Windows XP will become blue screen or reboot immediately.
Note: Attackers have to be able to login interactively.
Prohibit untrusted user login to your system.
Microsoft has issued a Security Bulletin(MS03-005) and the related
Detailed Microsoft Security Bulletin is available at:
Patches are available at:
. Microsoft Windows XP 32-bit Edition:
. Microsoft Windows XP 64-bit Edition:
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2003-0004 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems. Candidates may change significantly before they become official
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENTSHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.
NSFOCUS Security Team <[email protected]>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
-----END PGP SIGNATURE-----