[SECURITY-L] [0_46831_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com: Microsoft Security Bulletin MS03-013: Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493)]

Ter Abr 22 13:56:55 -03 2003

----- Forwarded message from Microsoft <0_46831_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com> -----

From: "Microsoft" <0_46831_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com>
Subject: Microsoft Security Bulletin MS03-013: Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493)
To: <mieko em ccuec.unicamp.br>
Date: Wed, 16 Apr 2003 15:58:31 -0700
X-Mailer: Microsoft CDO for Windows 2000

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title:      Buffer Overrun in Windows Kernel Message Handling could 
            Lead to Elevated Privileges (811493)
Date:       16 April 2003
Software:   Microsoft Windows NT 4.0, Windows 2000, and Windows XP
Impact:     Local Elevation of Privilege
Max Risk:   Important
Bulletin:   MS03-013

Microsoft encourages customers to review the Security Bulletins at: 
http://www.microsoft.com/technet/security/bulletin/MS03-013.asp
http://www.microsoft.com/security/security_bulletins/ms03-013.asp
- ----------------------------------------------------------------------

Issue:
======
The Windows kernel is the core of the operating system. It provides 
system level services such as device and memory management, 
allocates processor time to processes and manages error handling.

There is a flaw in the way the kernel passes error messages to a 
debugger. A vulnerability results because an attacker could write a 
program to exploit this flaw and run code of their choice. An 
attacker could exploit this vulnerability to take any action on the 
system including deleting data, adding accounts with administrative 
access, or reconfiguring the system. 

For an attack to be successful, an attacker would need to be able 
to logon interactively to the system, either at the console or 
through a terminal session. Also, a successful attack would require 
the introduction of code in order to exploit this vulnerability. 
Because best practices recommends restricting the ability to logon 
interactively on servers, this issue most directly affects client 
systems and terminal servers.

Mitigating Factors:
====================
- - A successful attack requires the ability to logon 
  interactively to the target machine, either directly at the console
  or through a terminal session. 
- - Properly secured servers would be at little risk from this 
  vulnerability. Standard best practices recommend only allowing 
  trusted administrators to log onto such systems interactively; 
  without such privileges, an attacker could not exploit the 
  vulnerability.

Risk Rating:
============
Important

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletins at
   http://www.microsoft.com/technet/security/bulletin/ms03-013.asp
   http://www.microsoft.com/security/security_bulletins/ms03-013.asp

   for information on obtaining this patch.

Acknowledgment:
===============
 - Oded Horovitz of Entercept Security Technologies - 
http://www.entercept.com 
- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE 
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, 
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF 
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION 
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES 
SO THE FOREGOING LIMITATION MAY NOT APPLY.

You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service.  For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp 

If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.

----- End forwarded message -----