• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability

Severity: CRITICAL

Description:

A vulnerability in Microsoft Windows Workstation service has been reported. Because of this issue, it may be possible for a remote attacker to gain unauthorized access to a vulnerable host.

The problem is in the handling of requests by the Workstation Service (WKSSVC.DLL). The Workstation Service is accessed by a remote system through Remote Procedure Call (RPC). RPC is handled through services listening on TCP and UDP ports 138, 139, and 445. It should also be noted that the service may bind dynamically to TCP/UDP ports above 1024, which presents an additional attack vector.

The Workstation Service does not properly check bounds on remote data. Because of this, it is possible to overwrite sensitive regions of system memory. The problem exists due to insufficient bounds checking in the network management functions provided through the DCE/RPC service. Some of these management events generate a logfile in the 'Debug' subdirectory within the Windows installation folder. When log entries are created, the logging function in 'WKSSVC.DLL' calls the 'vsprintf' routine without performing bounds checking. Therefore, if an exceptionally long string is provided as a parameter to an RPC function that writes it to the log file, a stack-based buffer overflow will occur.

While exploitation does require that the debug directory can be written to, there are undocumented APIs on Windows XP that can bypass this restriction on NTFS filesystems. Exploitation on FAT filesystems would not require the use of this API.

*** An additional attack vector has been discovered by Core Security Technologies through which an attacker need only send a single UDP packet to a broadcast address to exploit all vulnerable systems on a target network. This method of exploitation could greatly increase the speed of an attack and a specially crafted exploit packet with a source port of 53 may pass undetected by firewalls that loosely allow inbound DNS traffic to high ports on internal systems. The attack vector exists because there are no confirmation packets that are needed to carry out an attack and an attacker may use spoofed UDP packets with an arbitrary source port to exploit this issue. By spoofing the attack packets as if they came from a trusted DNS server an attacker may be able to bypass common firewall filtering rules. This vector also may apply to the Microsoft Windows Messenger Service Buffer Overrun Vulnerability (BID 8826).

This issue could be exploited by a remote user to execute code with the privileges of the Workstation Service, which is typically invoked with SYSTEM privileges.

Affected Products:

• Avaya DefinityOne Media Servers
• Avaya IP600 Media Servers
• Avaya S3400 Message Application Server
• Avaya S8100 Media Servers
• Cisco Broadband Troubleshooter
• Cisco Building BroadBand Services Manager Hotspot 1.0.0
• Cisco Building Broadband Service Manager 2.5.1
• Cisco Building Broadband Service Manager 3.0.0
• Cisco Building Broadband Service Manager 4.0.1
• Cisco Building Broadband Service Manager 4.2.0
• Cisco Building Broadband Service Manager 4.3.0
• Cisco Building Broadband Service Manager 4.4.0
• Cisco Building Broadband Service Manager 4.5.0
• Cisco Building Broadband Service Manager 5.0.0
• Cisco Building Broadband Service Manager 5.1.0
• Cisco Call Manager
• Cisco Call Manager 1.0.0
• Cisco Call Manager 2.0.0
• Cisco Call Manager 3.0.0
• Cisco Call Manager 3.1.0
• Cisco Call Manager 3.1.0 (2)
• Cisco Call Manager 3.1.0 (3a)
• Cisco Call Manager 3.2.0
• Cisco Call Manager 3.3.0
• Cisco Call Manager 3.3.0 (3)
• Cisco Call Manager 4.0.0
• Cisco CiscoWorks VPN/Security Management Solution
• Cisco Collaboration Server
• Cisco Conference Connection
• Cisco Conference Connection 1.1.0 (1)
• Cisco Conference Connection 1.2.0
• Cisco Customer Response Application Server
• Cisco DOCSIS CPE Configurator
• Cisco Dynamic Content Adapter
• Cisco E-Mail Manager
• Cisco IP Call Center Express (IPCC Express) Enhanced 3.0.0
• Cisco IP Call Center Express (IPCC Express) Standard 3.0.0
• Cisco IP Telephony Environment Monitor
• Cisco IP/TV Server
• Cisco IP/VC 3540 Application Server
• Cisco IP/VC 3540 Video Rate Matching Module
• Cisco Intelligent Contact Manager
• Cisco Intelligent Contact Manager 5.0.0
• Cisco Internet Service Node
• Cisco Lan Management Solution
• Cisco Media Blender
• Cisco Network Registar
• Cisco Networking Services for Active Directory
• Cisco Personal Assistant
• Cisco Personal Assistant 1.3.0 (1)
• Cisco Personal Assistant 1.3.0 (2)
• Cisco Personal Assistant 1.3.0 (3)
• Cisco Personal Assistant 1.3.0 (4)
• Cisco Personal Assistant 1.4.0 (1)
• Cisco Personal Assistant 1.4.0 (2)
• Cisco QoS Policy Manager
• Cisco Routed Wan Management
• Cisco SN 5420 Storage Router 1.1.0 (2)
• Cisco SN 5420 Storage Router 1.1.0 (3)
• Cisco SN 5420 Storage Router 1.1.0 (4)
• Cisco SN 5420 Storage Router 1.1.0 (5)
• Cisco SN 5420 Storage Router 1.1.0 (7)
• Cisco SN 5420 Storage Router 1.1.3
• Cisco SN 5428 Storage Router SN5428-2-3.3.1-K9
• Cisco SN 5428 Storage Router SN5428-2-3.3.2-K9
• Cisco SN 5428 Storage Router SN5428-2.5.1-K9
• Cisco SN 5428 Storage Router SN5428-3.2.1-K9
• Cisco SN 5428 Storage Router SN5428-3.2.2-K9
• Cisco SN 5428 Storage Router SN5428-3.3.1-K9
• Cisco SN 5428 Storage Router SN5428-3.3.2-K9
• Cisco Secure Access Control Server
• Cisco Secure Access Control Server 3.2.0 (1.20)
• Cisco Secure Access Control Server 3.2.1
• Cisco Secure Access Control Server 3.2.2
• Cisco Secure Policy Manager 3.0.1
• Cisco Secure Scanner
• Cisco Service Management
• Cisco Small Network Management Solution
• Cisco Trailhead
• Cisco Transport Manager
• Cisco Unity Server
• Cisco Unity Server 2.0.0
• Cisco Unity Server 2.1.0
• Cisco Unity Server 2.2.0
• Cisco Unity Server 2.3.0
• Cisco Unity Server 2.4.0
• Cisco Unity Server 2.46.0
• Cisco Unity Server 3.0.0
• Cisco Unity Server 3.1.0
• Cisco Unity Server 3.2.0
• Cisco Unity Server 3.3.0
• Cisco Unity Server 4.0.0
• Cisco User Registration Tool
• Cisco VoIP Phone 7902G
• Cisco VoIP Phone 7905G
• Cisco VoIP Phone 7912G
• Cisco Voice Manager
• Cisco uOne Enterprise Edition
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Datacenter Server SP3
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Professional SP3
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Server SP1
• Microsoft Windows 2000 Server SP2
• Microsoft Windows 2000 Server SP3
• Microsoft Windows 2000 Server SP4
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 2000 Terminal Services SP1
• Microsoft Windows 2000 Terminal Services SP2
• Microsoft Windows XP 64-bit Edition
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP Home
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Media Center Edition
• Microsoft Windows XP Professional
• Microsoft Windows XP Professional SP1

References:

• CERT: CERT® Advisory CA-2003-28 Buffer Overflow in Windows Workstation Service
• CORE Security: MSRPC WKSSVC exploit
• Cisco: Cisco Security Advisory: Buffer Overrun in Microsoft Windows 2000 Workstation Se
• Microsoft: Microsoft Security Bulletin MS03-049
• eEye Digital Security: Windows Workstation Service Remote Buffer Overflow

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.