National Cyber Awareness System

Vulnerability Summary for CVE-2003-0717

Overview

The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#575892

Name: VU#575892

Type: Advisory; Patch Information

Hyperlink:http://www.kb.cert.org/vuls/id/575892

CERT/CC Advisory: CA-2003-27

Name: CA-2003-27

Hyperlink:http://www.cert.org/advisories/CA-2003-27.html

External Source: BID

Name: 8826

Type: Advisory; Patch Information; Exploit

Hyperlink:http://www.securityfocus.com/bid/8826

External Source: MS

Name: MS03-043

Type: Advisory; Patch Information

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms03-043.asp

External Source: BUGTRAQ

Name: 20031016 MS03-043 Popup Messenger Servce buffer-overflow

Hyperlink:http://marc.theaimsgroup.com/?l=ntbugtraq&m=106632188709562&w=2

External Source: BUGTRAQ

Name: 20031018 Proof of concept for Windows Messenger Service overflow

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=106666713812158&w=2

US Government Resource: oval:org.mitre.oval:def:268

Name: oval:org.mitre.oval:def:268

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:268

US Government Resource: oval:org.mitre.oval:def:213

Name: oval:org.mitre.oval:def:213

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:213

References to Check Content

Identifier:oval:org.mitre.oval:def:213

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:213

Identifier:oval:org.mitre.oval:def:268

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:268