Microsoft Windows NetDDE Buffer Overflow Vulnerability - Secunia Advisories - Vulnerability Intelligence

Microsoft Windows NetDDE Buffer Overflow Vulnerability
Secunia Advisory:	SA12803	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2004-10-12
Last Update:	2005-01-24
Popularity:	15,078 views

Critical:	Moderately critical
Impact:	System access
Where:	From local network
Solution Status:	Vendor Patch

OS:	Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Professional Microsoft Windows 2000 Server Microsoft Windows NT 4.0 Server Microsoft Windows NT 4.0 Server, Terminal Server Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows XP Home Edition Microsoft Windows XP Professional

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2004-0206

Description: John Heasman has reported a vulnerability in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the NetDDE (Network Dynamic Data Exchange) services within the "NDdeSetTrustedShare()" function. This can be exploited to cause a buffer overflow via specially crafted NetDDE messages. Successful exploitation allows execution of arbitrary code with SYSTEM privileges. NOTE: Microsoft Windows XP SP2 is not affected by this vulnerability. Solution: Apply patches. Microsoft Windows NT Server 4.0 (requires SP6a): http://www.microsoft.com/downloads/de...=A5CA71B6-8A5E-4AA9-B34E-7CE5B304CFAC Microsoft Windows NT Server 4.0 Terminal Server Edition (requires SP6): http://www.microsoft.com/downloads/de...=0A584B37-291C-4B63-971E-FB35CC361B13 Microsoft Windows 2000 (requires SP3 or SP4): http://www.microsoft.com/downloads/de...=80FE311A-B446-43D0-9614-B93112E28294 Microsoft Windows XP (prior to SP2): http://www.microsoft.com/downloads/de...=C6EB8FB6-6AAE-48BC-9E4F-271F81361AE0 Microsoft Windows XP 64-Bit Edition (requires SP1): http://www.microsoft.com/downloads/de...=7754DB47-5D9E-4652-8634-ECF7B9D6786C Microsoft Windows XP 64-Bit Edition Version 2003: http://www.microsoft.com/downloads/de...=0C73C1B4-0E12-49F9-BAB7-606B07BFF569 Microsoft Windows Server 2003: http://www.microsoft.com/downloads/de...=01CFA2F4-19B2-4771-8377-FB633C5BF464 Microsoft Windows Server 2003 64-Bit Edition: http://www.microsoft.com/downloads/de...=0C73C1B4-0E12-49F9-BAB7-606B07BFF569 Provided and/or discovered by: John Heasman, Next Generation Security Software. Changelog: 2005-01-24: Added additional information provided by NGSSoftware. Original Advisory: MS04-031 (KB841533): http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx NGSSoftware: http://www.nextgenss.com/advisories/netddefull.txt

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

20th Nov, 2008

New advisories:	24
New vulnerabilities:	48
Updated advisories:	34

Highly // 311 views

Alex Multiple Products File Upload Vulnerability

Moderately // 305 views

ClipShare "chid" SQL Injection Vulnerability

Moderately // 302 views

MauryCMS "c" SQL Injection Vulnerability

Less // 338 views

MyTopix "send" SQL Injection Vulnerability

Less // 353 views

MailScanner "trend-autoupdate" Insecure Temporary Files

Not // 324 views

P3nfs Insecure Temporary Files

Less // 359 views

pam_mount "passwdehd" Insecure Temporary Files

Less // 341 views

refbase "headerMsg" Cross-Site Scripting Vulnerability

Highly // 421 views

imlib2 XPM Processing Buffer Overflow Vulnerability

Less // 346 views

SystemImager "si_mkbootserver" Insecure Temporary Files

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.