OSVDB ID: 4467

Title: Microsoft Windows WebDav ntdll.dll Remote Overflow

Info

Disclosure
May 30, 2003

Discovery
Apr 24, 2003

Dates

Exploit
May 30, 2003

Solution
Unknown

Description

 Windows servers with WebDAV enabled contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the ntdll.dll component of the WebDAV not properly sanitizing input to a path conversion function. If an attacker sends a specially crafted request to this function, they may be able to execute arbitrary code with SYSTEM privileges.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public
Disclosure: OSVDB Verified, Discovered in the Wild

Solution

 Microsoft has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing the following workarounds): 1. Disable IIS if not required 2. Disable WebDav if not required

Products

Microsoft Corporation

Windows

 2000
NT 4.0
NT 4.0 Terminal Server Edition
XP

References

Credit
  • Operash - nesuminsofthome.net - Personal Page


Direct URL: http://osvdb.org/36218