Reported October 15, 2003, by Microsoft.
· Windows 2003
· Windows XP
· Windows 2000
· Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 (SP6)
· NT Server 4.0 SP6a
· NT Workstation 4.0 SP6a
A vulnerability in several Windows OS versions can result in the remote execution of arbitrary code on the vulnerable system under the security context of the logged-on user. This vulnerability is a result of a flaw in Authenticode that, under certain low-memory conditions, can permit the download and installation of an ActiveX control without presenting the user with an approval dialog box.
Microsoft has released security bulletin MS03-041, "Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)," which addresses this vulnerability, and recommends that affected users immediately apply the appropriate patch listed in the bulletin.
Discovered by Microsoft.