Microsoft Windows long file share name buffer overflow
| win-long-fileshare-bo (15956) |  High Risk |
Description:
Multiple releases of Microsoft Windows are vulnerable to a buffer overflow, caused by improper bounds checking of file names. A remote attacker, in control of a malicious file server, could create a file share name containing 300 or more characters to overflow a buffer and cause Internet Explorer or Windows Explorer to crash, and possibly execute arbitrary code on the system, once the victim attempts to map to or view the file.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-037. See References.
References:
- BugTraq Mailing List, Sun Apr 25 2004 - 17:01:53 CDT: Microsoft's Explorer and Internet Explorer long share name buffer overflow..
- CIAC Information Bulletin P-007: Microsoft Windows Shell and Program Group Converter Vulnerabilities.
- Full-Disclosure Mailing List, Sun Apr 25 2004 - 16:38:24 CDT : Microsoft's Explorer and Internet Explorer long share name buffer overflow..
- Microsoft Knowledge Base Article - 322857: Windows Explorer Quits and Generates an Error Message When You Try to Map a Network Drive.
- Microsoft Security Bulletin MS04-037: Vulnerability in Windows Shell Could Allow Remote Code Execution (841356).
- BID-10213: Microsoft Windows Shell Long Share Name Buffer Overrun Vulnerability
- CVE-2004-0214: Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.
- OSVDB ID: 5687: Microsoft Windows IE and Explorer Share Name Overflow
- SA11482: Windows Explorer / Internet Explorer Long Share Name Buffer Overflow
- SECTRACK ID: 1011647: Microsoft Windows Shell Buffer Overflows Let Remote Users Execute Arbitrary Code
- US-CERT VU#616200: Microsoft Windows Shell contains a buffer overflow
Platforms Affected:
- Microsoft Windows 2000 SP3
- Microsoft Windows 2000 SP4
- Microsoft Windows 2003 Server x64
- Microsoft Windows 2003 Server
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows Me
- Microsoft Windows NT 4.0 SP6a Server
- Microsoft Windows NT 4.0 SP6 Terminal Server
- Microsoft Windows XP 2003 x64
- Microsoft Windows XP
- Microsoft Windows XP SP1
- Microsoft Windows XP SP1 x64
Reported:
Apr 25, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net