PT-2005-3058 · Microsoft · Windows Xp+1
Derek Soeder
·
Publicado
2005-10-13
·
Atualizado
2018-10-12
·
CVE-2005-2120
CVSS v2.0
6.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Microsoft Windows versions prior to the fixed version, specifically including Windows 2000 SP4, and Windows XP SP1 and SP2
Description:
The issue is a stack-based buffer overflow in the Plug and Play (PnP) service, located in the UMPNPMGR.DLL module. This occurs when a large number of "" (backslash) characters are present in a registry key name, triggering the overflow in a
wsprintfW function call. This allows remote or local authenticated attackers to execute arbitrary code.Recommendations:
For Windows 2000 SP4 and Windows XP SP1 and SP2, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the Plug and Play (PnP) service to minimize the risk of exploitation.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Windows 2000
Windows Xp