PT-2003-1446 · Microsoft · Windows 2000+3

Brett Moore · Published 2003-05-30 · Updated 2020-11-13 · CVE-2003-0227

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Media Services versions prior to the fixed version in Windows NT 4.0 and 2000

Description: The issue concerns the logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services. It allows remote attackers to cause a denial of service in Internet Information Server (IIS) and potentially execute arbitrary code via a certain network request.

Recommendations: For Microsoft Windows Media Services in Windows NT 4.0 and 2000, apply the necessary patch or update to fix the issue in the nsiislog.dll ISAPI extension. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2003-0227

Affected Products

Internet Information Server

Windows 2000

Windows Media Services

Windows Nt 4.0

References · 8

• 🔥 https://exploit-db.com/exploits/56 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0227 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A936 · Note
• http://marc.info/?l=ntbugtraq&m=105421176432011&w=2 · Note
• http://marc.info/?l=bugtraq&m=105427615626177&w=2 · Note
• http://marc.info/?l=ntbugtraq&m=105421127531558&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A966 · Note