Microsoft Windows 2000 MS03-007 patch is not installed on the system
| win2k-ms03007-patch (11617) |  High Risk |
Description:
Microsoft Windows 2000 supports the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol, which is an extension to the HTTP 1.1 protocol to add distributed authoring and version control to Web content. A buffer overflow vulnerability in a path conversion function occurs within NtDLL a Windows component used by WebDAV, is addressed in Microsoft Security Bulletin MS03-007. This vulnerability could allow an attacker to gain local SYSTEM privileges.
Consequences:
Gain Access
Remedy:
Verify that Microsoft WebDAV Service is running on the system for legitimate reasons. If use of WebDAV is required, ensure that security settings had been configured or patches had been applied for best security practices. If use of WebDAV is not required or if it was enabled under suspicious circumstances, disable it from the system.
IIS administrators may temporarily disable WebDAV support on IIS 5 servers if possible. Microsoft Knowledge Base Article 241520 describes the process in detail. See References.
References:
- CIAC Information Bulletin N-054: Microsoft Unchecked Buffer in Windows Component Could Cause Web Server Compromise.
- Microsoft Knowledge Base Article 241520: How to Disable WebDAV for IIS 5.0.
- Microsoft Security Bulletin MS03-007: Unchecked buffer in Windows component could cause web server compromise (815021).
- BID-7116: Microsoft Windows ntdll.dll Buffer Overflow Vulnerability
- CVE-2003-0109: Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.
Platforms Affected:
- Microsoft Windows 2000
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 Terminal Server
- Microsoft Windows XP
Reported:
Mar 17, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net