|
Microsoft Windows Media Services Remote System Access
|
|
Secunia Advisory:
|
SA9115
|
|
|
Release Date:
|
2003-06-25
|
|
Last Update:
|
2004-03-10
|
|
Popularity:
|
11,838 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Microsoft Internet Information Services (IIS) 5.x
Microsoft Windows Media Services 4.x SDK
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2003-0349
|
|
Description:
Microsoft has issued an update for Windows Media Services on Windows 2000 (Internet Information Services 5.0) due to a vulnerability allowing malicious people to gain system access.
The problem is that a buffer overflow exists in the logging facility "nsiislog.dll", which is part of Windows Media Services. It may be exploited by sending a malicious HTTP request.
Only Internet Information Services on Windows 2000 with Windows Media Services enabled is vulnerable (not enabled by default).
Solution:
A patch is available:
http://microsoft.com/downloads/detail...-9E78-F71D9742FED8&displaylang=en
Provided and/or discovered by:
Brett Moore
Changelog:
2004-03-10: Patch re-released to fix install issue.
Original Advisory:
http://www.microsoft.com/technet/security/Bulletin/MS03-022.mspx
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
