Secunia

Description

Microsoft Internet Security and Acceleration Server 2000 contain a vulnerability in the H.323 protocol implementation, which can be exploited by malicious people to cause a DoS (Denial of Service) or gain system access.

The vulnerability is caused due to various errors in the processing of H.323 traffic over TCP, which allows malicious people to overflow a buffer. This can be exploited by sending specially crafted messages to an affected system (default port 1720/tcp).

Successful exploitation may allow a malicious person to execute arbitrary code or crash a vulnerable system.

The H.323 filter is enabled by default on systems running in integrated or firewall mode.

Solution
Microsoft has issued a patch:
Further details available in Customer Area

Changelog
Further details available in Customer Area

Original Advisory
Microsoft:
http://www.microsoft.com/technet/security/bulletin/MS04-001.asp

NISCC:
http://www.uniras.gov.uk/vuls/2004/006489/h323.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area