Microsoft Windows Program Group Converter buffer overflow
| win-grpconv-bo (16664) |  High Risk |
Description:
Microsoft Windows Program Group Converter (Grpconv.exe) is vulnerable to a buffer overflow, caused by improper bounds checking of file names. A remote attacker could create a specially-crafted file to overflow the buffer and possibly execute arbitrary code on the system, once the victim opens the file.
Note: Exploitation of this vulnerability may be difficult since the parameter supplied by the attacker is stored in Unicode format.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-037. See References.
References:
- CIAC Informatin Bulletin P-007: Microsoft Windows Shell and Program Group Converter Vulnerabilities.
- Full-Disclosure Mailing List, Wed Jul 07 2004 - 14:25:12 CDT : Re: [Full-Disclosure] shell:windows command question.
- Microsoft Security Bulletin MS04-037: Vulnerability in Windows Shell Could Allow Remote Code Execution (841356).
- BID-10677: Microsoft Windows Program Group Converter Filename Local Buffer Overrun Vulnerability
- CVE-2004-0572: Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.
- US-CERT VU#543864: Microsoft Windows Program Group Converter vulnerable to buffer overflow
Platforms Affected:
- Microsoft Windows 2000 SP3
- Microsoft Windows 2000 SP4
- Microsoft Windows 2003 Server x64
- Microsoft Windows 2003 Server
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows Me
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6 Terminal Server
- Microsoft Windows XP 2003 x64
- Microsoft Windows XP
- Microsoft Windows XP SP1
- Microsoft Windows XP SP1 x64
Reported:
Jul 07, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net