PT-2004-1147 · Microsoft · Windows 98+8

Houseofdabus · Published 2004-04-16 · Updated 2018-10-12 · CVE-2003-0533

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows NT 4.0 SP6a Microsoft Windows 2000 SP2 through SP4 Microsoft Windows XP SP1 Microsoft Windows Server 2003 Microsoft NetMeeting Microsoft Windows 98 Microsoft Windows ME

Description A stack-based buffer overflow issue exists in certain Active Directory service functions within the Local Security Authority Subsystem Service (LSASS) due to the creation of long debug entries for the DCPROMO.LOG log file by the DsRolerUpgradeDownlevelServer function. This allows remote attackers to execute arbitrary code. The issue has been exploited by the Sasser worm.

Recommendations For Microsoft Windows NT 4.0 SP6a, apply the necessary patch to fix the issue. For Microsoft Windows 2000 SP2 through SP4, apply the necessary patch to fix the issue. For Microsoft Windows XP SP1, apply the necessary patch to fix the issue. For Microsoft Windows Server 2003, apply the necessary patch to fix the issue. For Microsoft NetMeeting, apply the necessary patch to fix the issue. For Microsoft Windows 98 and Windows ME, apply the necessary patch to fix the issue.

Exploit

Fix

Related Identifiers

CVE-2003-0533

Affected Products

Active Directory

Local Security Authority Subsystem Service

Netmeeting

Windows 2000

Windows 98

Windows Me

Windows Nt 4.0

Windows Server 2003

Windows Xp

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms04_011_lsass.rb · Exploit
• 🔥 https://exploit-db.com/exploits/295 · Exploit
• 🔥 https://exploit-db.com/exploits/293 · Exploit
• 🔥 https://exploit-db.com/exploits/16368 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0533 · Security Note
• http://kb.cert.org/vuls/id/753212 · Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A919 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020069.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A883 · Note
• http://securityfocus.com/bid/10108 · Note
• http://us-cert.gov/cas/techalerts/TA04-104A.html · Note
• http://ciac.org/ciac/bulletins/o-114.shtml · Note
• http://eeye.com/html/Research/Advisories/AD20040413C.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A898 · Note