CVE-2003-0533 Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4...
HighCVSS 7.5
EPSS 85.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft netmeeting | All versions | No fix listed |
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 98 | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20040413 EEYE: Windows Local Security Authority Service Remote Buffer Overflow mailing-list
- 20040429 MS04011 Lsasrv.dll RPC buffer overflow remote exploit (PoC) mailing-list
- O-114 government-resource third-party-advisory
- AD20040413C third-party-advisory
- VU#753212 patch third-party-advisory us-government-resource
- 10108 vdb-entry
- TA04-104A third-party-advisory us-government-resource
- MS04-011 vendor-advisory
- win-lsass-bo(15699) vdb-entry
- oval:org.mitre.oval:def:883 signature vdb-entry
- oval:org.mitre.oval:def:898 signature vdb-entry
- oval:org.mitre.oval:def:919 signature vdb-entry