Secunia

Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

1) An error in WINS (Windows Internet Name Service) when calculating a buffer length can be exploited to cause a heap-based buffer overflow via a specially crafted WINS push request.

Successful exploitation allows execution of arbitrary code, but requires that WINS is installed (not default).

2) An integer overflow error in WINS when validating data structures in WINS network packets can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code, but requires that WINS is installed (not default) and only affects Windows 2000 systems.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) an anonymous researcher, reported via ZDI
2) The vendor credits LiGen, National University of Defense Technology.

Changelog
Further details available in Customer Area

Original Advisory
MS09-039 (KB969883):
http://www.microsoft.com/technet/security/Bulletin/MS09-039.mspx

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-053/

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area