Microsoft Windows long file share name buffer overflow
| win-long-fileshare-bo (15956) |  High Risk |
Description:
Multiple releases of Microsoft Windows are vulnerable to a buffer overflow, caused by improper bounds checking of file names. A remote attacker, in control of a malicious file server, could create a file share name containing 300 or more characters to overflow a buffer and cause Internet Explorer or Windows Explorer to crash, and possibly execute arbitrary code on the system, once the victim attempts to map to or view the file.
Platforms Affected:
- Microsoft, Windows 2000 SP3
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server
- Microsoft, Windows 2003 Server x64
- Microsoft, Windows 98
- Microsoft, Windows 98SE
- Microsoft, Windows Me
- Microsoft, Windows NT 4.0 SP6 Terminal Server
- Microsoft, Windows NT 4.0 SP6a Server
- Microsoft, Windows XP 2003 64-bit
- Microsoft, Windows XP SP1
- Microsoft, Windows XP SP1 64-bit
- Microsoft, Windows XP
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-037. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Sun Apr 25 2004 - 17:01:53 CDT, Microsoft's Explorer and Internet Explorer long share name buffer overflow. at http://archives.neohapsis.com/archives/bugtraq/2004-04/0305.html.
- CIAC Information Bulletin P-007, Microsoft Windows Shell and Program Group Converter Vulnerabilities at http://www.ciac.org/ciac/bulletins/p-007.shtml.
- Full-Disclosure Mailing List, Sun Apr 25 2004 - 16:38:24 CDT , Microsoft's Explorer and Internet Explorer long share name buffer overflow. at http://archives.neohapsis.com/archives/fulldisclosure/2004-04/att-0913/explorer-vuln.txt.
- Microsoft Knowledge Base Article - 322857, Windows Explorer Quits and Generates an Error Message When You Try to Map a Network Drive at http://support.microsoft.com/default.aspx?scid=kb;en-us;322857.
- Microsoft Security Bulletin MS04-037, Vulnerability in Windows Shell Could Allow Remote Code Execution (841356) at http://www.microsoft.com/technet/security/Bulletin/MS04-037.mspx.
- BID-10213: Microsoft Windows Shell Long Share Name Buffer Overrun Vulnerability
- CVE-2004-0214: Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.
- OSVDB ID: 5687: Microsoft Windows IE and Explorer Share Name Overflow
- SA11482: Windows Explorer / Internet Explorer Long Share Name Buffer Overflow
- SECTRACK ID: 1011647: Microsoft Windows Shell Buffer Overflows Let Remote Users Execute Arbitrary Code
- US-CERT VU#616200: Microsoft Windows Shell contains a buffer overflow
Reported:
Apr 25, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net