Secunia

Microsoft has issued patches to fix a vulnerability in Microsoft Windows allowing malicious users to escalate their privileges.

The vulnerability is caused due to a boundary error in a function in "User32.dll" when handling certain parameters passed by "LB_DIR" and "CB_DIR" windows messages. Both the ListBox and the ComboBox Control call this function.

It is therefore possible to exploit the vulnerability by sending either a "LB_DIR" or "CB_DIR" message supplying an overly long, specially crafted pathname to a privileged process, which uses the ListBox or ComboBox Control.

Successful exploitation allows exection of arbitrary code with the same privileges as the process.

The vulnerability can be exploited via Utility Manager in Windows 2000. However, it can also be exploited via third party applications.

Solution
NOTE: It has been reported that the patch may cause Sophos Anti-virus and FirstClass Client to become inoperable on certain European version of Windows 2000. Other software may also be affected.
Further details available in Customer Area

Provided and/or discovered by
Brett Moore, Security-Assessment

Changelog
Further details available in Customer Area

Original Advisory
Buffer Overrun in the ListBox and in the ComboBox Control Could Allow Code Execution
http://www.microsoft.com/technet/security/bulletin/MS03-045.asp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area