Accessibility Options |  Sitemap |  Contact Us
   
 
 
 
HOME space ABOUTCERTIn space KNOWLEDGEBASE space TRAINING space ADVISORIES space VULNOTES space space Facebook space x space insta space youtube space Linkedin
WLine
DigitalIndia
WLine
csk
WLine
Full Member FIRST
Line
Operational Member TFCSIRT
Line
Accredited Member APCERT
Line
Global Research Partner APWG
Line
Associate Partner Charter
Line
CNA
WLine
 Directions by CERT-In under  Section 70B, Information  Technology Act 2000
WLine
 Guidelines on Information  Security Practices for  Government Entities
WLine
 Technical Guidelines on NEW  SOFTWARE BILL OF MATERIALS  (SBOM)
WLine
 Cyber Security GuidelinesNEW  for Smart City Infrastructure
About CERT-in
Line
point point Client's /Citizen's Charter
Line
point point Roles & Functions
Line
point point Advisory Committee
Line
point point Act/Rules/Regulations
Line
point point Internal Complaint Committee         (ICC) 
Line
point point RFC2350 
line
point point Press  
Line
point point Tender 
Line
point point Subscribe Mailing List
Line
point point Contact Us
Line
Line
Reporting
point
 Incident Reporting
point
Line
point
 Vulnerability Reporting
point
Line
point
 Feedback
point
Line
KnowledgeBase
Line
point Point Guidelines
Line
point Point Presentations
Line
point Point White Papers 
Line
point Point Annual Report 
Line
Line
Line
line
Line
line
line
Advisories
Line
VulnerabilityNotes
Line
RelatedLinks
Line
point Point World CERTs
Line
point point Antivirus Resources
line
point point FAQ
line
line
Line
Line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
spacer
Home - AdvisoriesPrint
point

CERT-In Advisory CIAD-2003-0017

Buffer Overrun in the Workstation Service Could Allow Code Execution

Original Issue Date: November 12, 2003

Severity Rating: High

Systems Affected

  • Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
  • Microsoft Windows XP
  • Microsoft Windows XP Service Pack 1
  • Microsoft Windows XP 64-Bit Edition

Overview

A security vulnerability exists in the Windows Workstation service WKSSVC.DLL that could allow remote code execution on an affected system. This vulnerability results because of an unchecked buffer in the Windows Workstation service. If exploited, an attacker could take any action on the system, including installing programs, viewing data, changing data, or deleting data, or creating new accounts with full privileges.

Impact

An attacker could gain System privileges on an affected system, or could cause the Workstation service to fail.

Description

An unauthenticated attacker could exploit this vulnerability to execute arbitrary code with system-level privileges on Windows 2000 and Windows XP machines. The susceptible Workstation functionality is accessible via the WKSSVC named pipe TCP ports 139 and 445 . This buffer overflow bug is within network management functions provided by the DCE/RPC service. 

The buffer overflow bug is in a logging function which generates a string for the log file using vsprintf .

Solution

Apply patch

Apply the cumulative patch (828749) referenced in Microsoft Security Bulletin MS03-043  
Windows XP users who applied Microsoft security update (MS03-043 ) (828035 ) need not reapply this patch, as the security update (828035) include the updated file that helps protect from this vulnerability. However, for Windows 2000 users who applied Microsoft security update (MS03-043 ) (828035 ) require applying this security update (828749).  

Workaround

These workarounds help block known attack vectors, however they will not correct the underlying vulnerability, for correcting the vulnerability refer to solution.

  • Block UDP ports 138, 139, 445 and TCP ports 138, 139, 445 at firewall level.
  • Use a personal firewall such as Internet Connection Firewall, which is included with Windows XP.
  • Enable advanced TCP/IP filtering on Windows 2000-based systems and on Windows XP-based systems.
  • Disable the Workstation service.

Impact of Workaround:

If the Workstation service is disabled, the system cannot connect to any shared file resources or shared print resources on a network. Only use this workaround on stand-alone systems such as many home systems that do not connect to a network. If the Workstation service is disabled, any services that explicitly depend on the Workstation service do not start, and an error message is logged in the system event log. The following services depend on the Workstation service:

  • Alerter 
  • Browser 
  • Messenger 
  • Net Logon 
  • RPC Locator

These services are required to access resources on a network and to perform domain authentication. Internet connectivity and browsing for stand-alone systems, such as users on dial-up connections, on DSL connections, or on cable modem connections, should not be affected if these services are disabled.

Note: The Microsoft Baseline Security Analyzer will not function if the Workstation service is disabled. It is possible that other applications may also require the Workstation service. If an application requires the Workstation service, simply re-enable the service.

Vendor Information

Microsoft
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp

References

Microsoft Security Bulletin MS03-049 828749
http://www.microsoft.com/technet/treeview/default.asp?rl=/technet/security/bulletin/MS03-049.asp

CERT/CC Advisory AD-2003-28
http://www.cert.org/advisories/CA-2003-28.html

eEye Digital Security Advisory
http://www.eeye.com/html/Research/Advisories/AD20031111.html

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India

 
Indian Computer Emergency Response Team - CERT-In, Ministry of Electronics and Information Technology, Government of India.
Website Policies |  Terms of Use |  Help Last Updated On May 01, 2025