PT-2004-1156 · Microsoft · Windows 2000+7

Publicado 2004-04-16 · Atualizado 2018-10-12 · CVE-2003-0719

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows NT 4.0 SP6a Microsoft Windows 2000 SP2 through SP4 Microsoft Windows XP SP1 Microsoft Windows Server 2003 Microsoft NetMeeting Microsoft Windows 98 Microsoft Windows ME

Description The issue is related to a buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library. This allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.

Recommendations For Microsoft Windows NT 4.0 SP6a, apply the necessary patch to fix the buffer overflow issue. For Microsoft Windows 2000 SP2 through SP4, apply the necessary patch to fix the buffer overflow issue. For Microsoft Windows XP SP1, apply the necessary patch to fix the buffer overflow issue. For Microsoft Windows Server 2003, apply the necessary patch to fix the buffer overflow issue. For Microsoft NetMeeting, apply the necessary patch to fix the buffer overflow issue. For Microsoft Windows 98 and Windows ME, apply the necessary patch to fix the buffer overflow issue.

Exploit

Correção

Identificadores relacionados

CVE-2003-0719

Produtos afetados

Ssl Library

Netmeeting

Windows 2000

Windows 98

Windows Me

Windows Nt 4.0

Windows Server 2003

Windows Xp

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ssl/ms04_011_pct.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16334 · Exploit
• 🔥 https://exploit-db.com/exploits/275 · Exploit
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A889 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0719 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1093 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A903 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011 · Aviso do Fabricante
• http://xforce.iss.net/xforce/alerts/id/168 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A951 · Nota
• http://securityfocus.com/archive/1/361836 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/586540 · Correção
• http://us-cert.gov/cas/techalerts/TA04-104A.html · Nota