Microsoft ListBox/ComboBox Control User32.dll函数缓冲区溢出漏洞

漏洞信息详情

Microsoft ListBox/ComboBox Control User32.dll函数缓冲区溢出漏洞

• CNNVD编号：CNNVD-200311-043
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2003-0659
  
• 漏洞类型：
  
  
  缓冲区溢出
  
• 发布时间：
  
  2003-11-17
  
• 威胁类型：
  
  
  本地
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  microsoft
• 漏洞来源：
  This discovery of …

Windows NT到Server 2003版本中User32.dll文件的一个函数存在缓冲区溢出漏洞。本地用户可以通过可享有特权应用程序中超长的(1) ListBox的LB_DIR消息或 (2) ComboBox的CB_DIR消息执行任意代码。

Microsoft has released a patch that will address this issue.
Microsoft has released updated information concerning Microsoft Security Bulletin MS03-045. Microsoft has reported that a compatibility problem with an unspecified third party software has been identified with a set of language specific versions of the Windows 2000 Service Pack 4 patch. However, this problem is unrelated to the security vulnerability discussed in MS03-045. Customers who have applied the patch are protected against the vulnerability discussed in this bulletin. The vendor has released new information to reflect the availability of the updated patch for specific languages. Please see the referenced Microsoft Security Bulletin MS03-045 for more information.
Revision 2.0 of the bulletin was also released to provide updated patches for Windows XP to address an unrelated problem with Debug Programs (SeDebugPrivilege). These patches can be found in the same location as the initial patches. Please see the updated bulletin for further details.
Microsoft Windows 2000 Server SP2

• Microsoft Security Update for Microsoft Windows 2000 Service Pack 2: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=01358EAC-F1C5
  -4CB7-BE3D-64459F4AD3FD&displaylang=en

Microsoft Windows 2000 Advanced Server SP2

• Microsoft Security Update for Microsoft Windows 2000 Service Pack 2: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=01358EAC-F1C5
  -4CB7-BE3D-64459F4AD3FD&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Microsoft Windows Server 2003 64-bit Edition: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E4BD7C05-EA0E
  -49C7-9BDD-ABB496CA87CA&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Microsoft Windows Server 2003: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=02F97DE4-29DF
  -4D33-A33B-E7630349E69E&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Microsoft Windows Server 2003 64-bit Edition: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E4BD7C05-EA0E
  -49C7-9BDD-ABB496CA87CA&displaylang=en

Microsoft Windows XP 64-bit Edition SP1

• Microsoft Security Update for Microsoft Windows XP 64-bit Edition: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3E7B03BF-2231
  -4069-B76F-0BD69CF6E1D9&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Microsoft Windows Server 2003: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=02F97DE4-29DF
  -4D33-A33B-E7630349E69E&displaylang=en

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E
  -4897-8D29-0764997F1E42&displaylang=en

Microsoft Windows 2000 Professional SP3

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E
  -4897-8D29-0764997F1E42&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Microsoft Windows Server 2003: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=02F97DE4-29DF
  -4D33-A33B-E7630349E69E&displaylang=en

Microsoft Windows 2000 Professional SP2

• Microsoft Security Update for Microsoft Windows 2000 Service Pack 2: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=01358EAC-F1C5
  -4CB7-BE3D-64459F4AD3FD&displaylang=en

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E
  -4897-8D29-0764997F1E42&displaylang=en

Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Microsoft Windows Server 2003: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=02F97DE4-29DF
  -4D33-A33B-E7630349E69E&displaylang=en

Microsoft Windows 2000 Advanced Server SP3

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E
  -4897-8D29-0764997F1E42&displaylang=en

Microsoft Windows XP Embedded SP1

• Microsoft Security Update for Microsoft Windows XP: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=ABC764AC-5B7B
  -4B99-BF3E-F57352E4C507&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Microsoft Windows XP: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=ABC764AC-5B7B
  -4B99-BF3E-F57352E4C507&displaylang=en

Microsoft Windows 2000 Datacenter Server SP3

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=379F234D-CE7E
  -4897-8D29-0764997F1E42&displaylang=en

Microsoft Windows 2000 Server SP3

• Microsoft Security Update for Microsoft Windows 2000: KB824141
  

  参考网址

  来源:US-CERT Vulnerability Note: VU#967668
  名称: VU#967668
  链接:http://www.kb.cert.org/vuls/id/967668

  来源:CERT/CC Advisory: CA-2003-27
  名称: CA-2003-27
  链接:http://www.cert.org/advisories/CA-2003-27.html

  来源: BID
  名称: 8827
  链接:http://www.securityfocus.com/bid/8827

  来源: MS
  名称: MS03-045
  链接:http://www.microsoft.com/technet/security/bulletin/ms03-045.asp

  来源: NTBUGTRAQ
  名称: 20031016 Listbox And Combobox Control Buffer Overflow
  链接:http://marc.theaimsgroup.com/?l=ntbugtraq&m=106632111408343&w=2

  来源: XF
  名称: win-user32-control-bo(13424)
  链接:http://xforce.iss.net/xforce/xfdb/13424

  来源: BUGTRAQ
  名称: 20031016 Listbox And Combobox Control Buffer Overflow
  链接:http://marc.theaimsgroup.com/?l=bugtraq&m=106631999907035&w=2

  来源: US Government Resource: oval:org.mitre.oval:def:340
  名称: oval:org.mitre.oval:def:340
  链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:340

  来源: US Government Resource: oval:org.mitre.oval:def:201
  名称: oval:org.mitre.oval:def:201
  链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:201