---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Microsoft Windows Plug-and-Play Service Buffer Overflow SECUNIA ADVISORY ID: SA16372 VERIFY ADVISORY: http://secunia.com/advisories/16372/ CRITICAL: Moderately critical IMPACT: Privilege escalation, System access WHERE: >From local network OPERATING SYSTEM: Microsoft Windows XP Professional http://secunia.com/product/22/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ DESCRIPTION: ISS X-Force has reported a vulnerability in Microsoft Windows, which can be exploited by malicious users to gain escalated privileges or by malicious people to compromise a vulnerable system. The vulnerability is caused due to an boundary error in the Plug-and-Play service and can be exploited to cause a stack-based buffer overflow. Successful exploitation allows malicious users to gain escalated privileges. On Windows 2000, the vulnerability can be exploited by malicious people to execute arbitrary code without requiring valid user credentials. SOLUTION: Apply patches. Microsoft Windows 2000 (requires SP4): http://www.microsoft.com/downloads/details.aspx?FamilyId=E39A3D96-1C37-47D2-82EF-0AC89905C88F Microsoft Windows XP (requires SP1 or SP2): http://www.microsoft.com/downloads/details.aspx?FamilyId=9A3BFBDD-62EA-4DB2-88D2-415E095E207F Microsoft Windows XP Professional x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=89D90E25-4773-4782-AD06-9B7517BAB3C8 Microsoft Windows Server 2003: http://www.microsoft.com/downloads/details.aspx?FamilyId=6275D7B7-DAB1-47C8-8745-533EB471072C Microsoft Windows Server 2003 (for Itanium-based systems): http://www.microsoft.com/downloads/details.aspx?FamilyId=BE18D39D-3E4C-4C6F-B841-2CCD8D4C3F50 Microsoft Windows Server 2003 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=D976316D-3B17-4AD4-9198-513FFDAC98E4 PROVIDED AND/OR DISCOVERED BY: Neel Mehta, ISS X-Force. ORIGINAL ADVISORY: MS05-039 (KB899588): http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx ISS X-Force: http://xforce.iss.net/xforce/alerts/id/202 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------