Reported April 16, 2003, by Microsoft.
· Microsoft Windows XP
· Microsoft Windows 2000
· Microsoft Windows NT 4.0 Server, Terminal Services Edition
· Microsoft Windows NT 4.0
A new vulnerability exists in A new vulnerability exists in Windows XP, 2000 and NT 4.0 that could result in the execution of arbitrary code on the vulnerable system. This vulnerability is a result of flaw in the way that the Windows kernel passes error messages to a debugger. A potential attacker could exploit this vulnerability and take any action on the system including deleting data, adding accounts with administrative access, or reconfiguring the system. According to Microsoft, for this attack to be successful an attacker would need to be able to logon interactively to the system from either the console or through a terminal session.
The vendor, Microsoft, has released Security Bulletin MS03-013 (Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493)) to address this vulnerability, and recommends that affected users immediately apply the patch mentioned in the bulletin.
Discovered by Oded Horovitz of Entercept Security Technologies.