SMB: Microsoft Task Scheduler (.job) File Copy

This signature detects a Microsoft Task Scheduler (.job) file being copied over an SMB network share. Microsoft Windows XP Service Pack 1 and Microsoft Windows 2000 Service Pack 2 and earlier are vulnerable. Attackers can open a malicious .job file in Task Scheduler to execute arbitrary code and compromise the system.

Extended Description

Microsoft Task Scheduler is reported prone to a remote stack-based buffer overflow vulnerability. The source of the vulnerability is that data in '.job' files is copied into an internal buffer without sufficient bounds checking. It is reported that a remote attacker may exploit this vulnerability through Internet Explorer or Windows Explorer when the '.job' file is opened or a directory containing the file is rendered. The file could also be hosted on a share. Other attack vectors may also exist. It should be noted that while this issue does not affect Windows NT 4.0 SP6a, it may affect this platform if Internet Explorer 6 SP1 is installed.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_64-bit_edition_version_2003

References

CVE: CVE-2004-0212

URL: http://www.microsoft.com/technet/security/bulletin/MS04-022.mspx http://www.symantec.com/avcenter/venc/data/bloodhound.exploit.11.html

Short Name

SMB:EXPLOIT:DOT-JOB

Severity

Minor

Recommended

False

Recommended Action

None

SMB: Microsoft Task Scheduler (.job) File Copy

Extended Description

Affected Products

References

Found a potential security threat?