CVE-2003-0717 The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
HighCVSS 7.5
EPSS 61.0%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = enterprise | No fix listed |
| Microsoft windows 2003 server | = enterprise_64-bit | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 2003 server | = standard | No fix listed |
| Microsoft windows 2003 server | = web | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows nt | = 4.0-sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp2 | No fix listed |
| Microsoft windows nt | = 4.0-sp3 | No fix listed |
| Microsoft windows nt | = 4.0-sp4 | No fix listed |
| Microsoft windows nt | = 4.0-sp5 | No fix listed |
| Microsoft windows nt | = 4.0-sp6 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20031018 Proof of concept for Windows Messenger Service overflow mailing-list
- 20031016 MS03-043 Popup Messenger Servce buffer-overflow mailing-list
- CA-2003-27 third-party-advisory us-government-resource
- VU#575892 patch third-party-advisory us-government-resource
- 8826 exploit patch vdb-entry vendor-advisory
- MS03-043 vendor-advisory
- oval:org.mitre.oval:def:213 signature vdb-entry
- oval:org.mitre.oval:def:268 signature vdb-entry