Secunia

Microsoft has issued patches for Microsoft Windows to fix a buffer overflow vulnerability in Messenger Service, which could lead to execution of arbitrary code.

The problem is that the Messenger Service doesn't verify the length of messages. This allows malicious people to send messages, which causes a buffer overflow that may allow execution of arbitrary code.

The vulnerability only affects systems where the Messenger Service is enabled.

The Messenger Service is disabled by default on Microsoft Windows 2003.

Solution
NetBIOS and RPC traffic should be filtered at the network perimeter.
Further details available in Customer Area

Provided and/or discovered by
The Last Stage of Delirium Research Group

Changelog
Further details available in Customer Area

Original Advisory
Buffer Overrun in Messenger Service Could Allow Code Execution
http://www.microsoft.com/technet/security/bulletin/MS03-043.asp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area