PT-2009-4927 · Microsoft · Windows 2000 Sp4+1

Cody Pierce · Published 2009-11-11 · Updated 2024-02-09 · CVE-2009-2523

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4

Description The issue allows remote attackers to execute arbitrary code via a specially crafted RPC message, which triggers a heap-based buffer overflow. This can be exploited by sending a specially crafted network message to a computer running the License Logging service, allowing an attacker to take complete control of the system. The exploitation does not require authentication.

Recommendations For Microsoft Windows 2000 SP4, consider disabling the License Logging Server service until a patch is available to prevent exploitation. Restrict access to the LlsrLicenseRequestW method to minimize the risk of exploitation. Avoid using the License Logging service in untrusted networks until the issue is resolved.

Fix

RCE

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2009-2523

Affected Products

Windows 2000 Sp4

Windows

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2523 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2523 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-064 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6300 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-064 · Note
• http://us-cert.gov/cas/techalerts/TA09-314A.html · Note