[SECURITY-L] CAIS-Alerta: Vulnerabilidade no Microsoft ListBox e ComboBox Control (824141)

Seg Out 20 13:38:34 -02 2003

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject: CAIS-Alerta: Vulnerabilidade no Microsoft ListBox e ComboBox Control
 (824141)
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Wed, 15 Oct 2003 16:13:02 -0300 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----

Prezados,

O CAIS esta' repassando o alerta divulgado pela Microsoft, "Microsoft
Security Bulletin MS03-045: Buffer Overrun in the ListBox and in the
ComboBox Control Could Allow Code Execution (824141)", que trata da
identificacao de uma vulnerabilidade nos controles ListBox e ComboBox que
pode ser explorada remotamente permitindo a um atacante local a execucao
de codigo arbitrario.

A vulnerabilidade existe nos controles ListBox e ComboBox, pois ambos
utilizam uma funcao que esta' localizada no arquivo User32.dll e que
contem um buffer overrun.

Sistemas Afetados:

	. Microsoft Windows NT Workstation 4.0, Service Pack 6a
	. Microsoft Windows NT Server 4.0, Service Pack 6a
	. Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6
	. Microsoft Windows 2000, Service Pack 2
	. Microsoft Windows 2000 Service Pack 3, Service Pack 4
	. Microsoft Windows XP Gold, Service Pack 1
	. Microsoft Windows XP 64 bit Edition
	. Microsoft Windows XP 64 bit Edition Version 2003
	. Microsoft Windows Server 2003
	. Microsoft Windows Server 2003 64 bit Edition

Siatemas nao Afetados:

	. Microsoft Windows Millennium Edition

Correções disponíveis:

A correção consiste na aplicação do patch recomendado pela Microsoft e
disponível em:

. Microsoft Windows NT Workstation 4.0, Service Pack 6a
http://www.microsoft.com/downloads/details.aspx?FamilyId=5EA88ABE-8D53-4E25-959C-E80EB5FD7A91&displaylang=en

. Microsoft Windows NT Server 4.0, Service Pack 6a
http://www.microsoft.com/downloads/details.aspx?FamilyId=F3E87075-AAE5-49F4-9D37-24A116296188&displaylang=en

. Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6
http://www.microsoft.com/downloads/details.aspx?FamilyId=0ADC8D90-2355-49A0-976B-57281B4521C1&displaylang=en

. Microsoft Windows 2000, Service Pack 2
http://www.microsoft.com/downloads/details.aspx?FamilyId=01358EAC-F1C5-4CB7-BE3D-64459F4AD3FD&displaylang=en

. Microsoft Windows 2000 Service Pack 3, Service Pack 4
http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E-4897-8D29-0764997F1E42&displaylang=en

. Microsoft Windows XP Gold, Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=ABC764AC-5B7B-4B99-BF3E-F57352E4C507&displaylang=en

. Microsoft Windows XP 64 bit Edition
http://www.microsoft.com/downloads/details.aspx?FamilyId=3E7B03BF-2231-4069-B76F-0BD69CF6E1D9&displaylang=en

. Microsoft Windows XP 64 bit Edition Version 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=E4BD7C05-EA0E-49C7-9BDD-ABB496CA87CA&displaylang=en

. Microsoft Windows Server 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=02F97DE4-29DF-4D33-A33B-E7630349E69E&displaylang=en

. Microsoft Windows Server 2003 64 bit Edition
http://www.microsoft.com/downloads/details.aspx?FamilyId=E4BD7C05-EA0E-49C7-9BDD-ABB496CA87CA&displaylang=en

Maiores informações:

http://www.microsoft.com/technet/security/bulletin/ms03-045.asp

Identificadores do CVE: CAN-2003-0659, (http://cve.mitre.org)

O CAIS recomenda aos administradores de plataformas Microsoft que
mantenham seus sistemas e aplicativos sempre atualizados.

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

Title: Buffer Overrun in the ListBox and in the ComboBox Control
Could Allow Code Execution (824141)

Date: October 15, 2003

Software: Microsoft Windows NT Workstation 4.0, Service Pack 6a; Microsoft
Windows NT Server 4.0, Service Pack 6a; Microsoft Windows NT Server 4.0,
Terminal Server Edition, Service Pack 6; Microsoft Windows 2000, Service
Pack 2; Microsoft Windows 2000 Service Pack 3, Service Pack 4; Microsoft
Windows XP Gold, Service Pack 1; Microsoft Windows XP 64 bit Edition;
Microsoft Windows XP 64 bit Edition Version 2003;  Microsoft Windows
Server 2003; Microsoft Windows Server 2003 64 bit Edition;

Impact: Local Elevation of Privilege

Maximum Severity Rating: Important

Bulletin: MS03-045

The Microsoft Security Response Center has released Microsoft
Security Bulletin MS03-045

What Is It?
The Microsoft Security Response Center has released Microsoft
Security Bulletin MS03-045 which concerns a vulnerability in the
above listed versions of Windows.  Customers are advised to review
the information in the bulletin, test and deploy the patch
immediately in their environments, if applicable.

More information is now available at
http://www.microsoft.com/technet/security/bulletin/MS03-045.asp

If you have any questions regarding this alert please contact your
Technical Account Manager or Application Development Consultant.