Microsoft Windows Program Group Converter buffer overflow
| win-grpconv-bo (16664) |  High Risk |
Description:
Microsoft Windows Program Group Converter (Grpconv.exe) is vulnerable to a buffer overflow, caused by improper bounds checking of file names. A remote attacker could create a specially-crafted file to overflow the buffer and possibly execute arbitrary code on the system, once the victim opens the file.
Note: Exploitation of this vulnerability may be difficult since the parameter supplied by the attacker is stored in Unicode format.
Platforms Affected:
- Microsoft, Windows 2000 SP3
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server
- Microsoft, Windows 2003 Server x64
- Microsoft, Windows 98
- Microsoft, Windows 98SE
- Microsoft, Windows Me
- Microsoft, Windows NT 4.0 SP6 Terminal Server
- Microsoft, Windows NT 4.0 SP6a
- Microsoft, Windows XP 2003 64-bit
- Microsoft, Windows XP SP1
- Microsoft, Windows XP SP1 64-bit
- Microsoft, Windows XP
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-037. See References.
Consequences:
Gain Access
References:
- CIAC Informatin Bulletin P-007, Microsoft Windows Shell and Program Group Converter Vulnerabilities at http://www.ciac.org/ciac/bulletins/p-007.shtml.
- Full-Disclosure Mailing List, Wed Jul 07 2004 - 14:25:12 CDT , Re: [Full-Disclosure] shell:windows command question at http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0290.html.
- Microsoft Security Bulletin MS04-037, Vulnerability in Windows Shell Could Allow Remote Code Execution (841356) at http://www.microsoft.com/technet/security/Bulletin/MS04-037.mspx#EABUAA.
- BID-10677: Microsoft Windows Program Group Converter Filename Local Buffer Overrun Vulnerability
- CVE-2004-0572: Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.
- US-CERT VU#543864: Microsoft Windows Program Group Converter vulnerable to buffer overflow
Reported:
Jul 07, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net