PT-2003-1785 · Microsoft · User32.Dll+2

Brett Moore · Published 2003-10-17 · Updated 2019-04-30 · CVE-2003-0659

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Windows NT through Server 2003

Description: A buffer overflow issue exists in the User32.dll on Windows, allowing local users to execute arbitrary code. This can be achieved by sending long LB DIR messages to ListBox or CB DIR messages to ComboBox controls in a privileged application.

Recommendations: For Windows NT through Server 2003, consider restricting access to privileged applications that utilize ListBox or ComboBox controls to minimize the risk of exploitation. As a temporary workaround, avoid using the LB DIR and CB DIR messages in these controls until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2003-0659

Affected Products

User32.Dll

Windows Nt

Windows Server 2003

References · 12

• 🔥 https://exploit-db.com/exploits/23255 · Exploit
• 🔥 https://exploit-db.com/exploits/122 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-045 · Vendor Advisory
• http://kb.cert.org/vuls/id/967668 · Patch
• http://securityfocus.com/bid/8827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0659 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13424 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A340 · Note
• http://marc.info/?l=ntbugtraq&m=106632111408343&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A201 · Note
• http://cert.org/advisories/CA-2003-27.html · Note
• http://marc.info/?l=bugtraq&m=106631999907035&w=2 · Note