Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repeated crash) and possibly execute arbitrary code via a .url file with an InternetShortcut tag containing a long URL and a large number of file: specifiers.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Windows_2003_server | Microsoft | 3.1.0.3270 (including) | 3.1.0.3270 (including) |
| Windows_2003_server | Microsoft | 64-bit (including) | 64-bit (including) |
| Windows_2003_server | Microsoft | datacenter_64-bit-sp1 (including) | datacenter_64-bit-sp1 (including) |
| Windows_2003_server | Microsoft | datacenter_64-bit-sp1_beta_1 (including) | datacenter_64-bit-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | datacenter_edition (including) | datacenter_edition (including) |
| Windows_2003_server | Microsoft | datacenter_edition-sp1 (including) | datacenter_edition-sp1 (including) |
| Windows_2003_server | Microsoft | datacenter_edition-sp1_beta_1 (including) | datacenter_edition-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | datacenter_edition_64-bit (including) | datacenter_edition_64-bit (including) |
| Windows_2003_server | Microsoft | datacenter_edition_64-bit-sp1 (including) | datacenter_edition_64-bit-sp1 (including) |
| Windows_2003_server | Microsoft | datacenter_edition_64-bit-sp1_beta_1 (including) | datacenter_edition_64-bit-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | enterprise (including) | enterprise (including) |
| Windows_2003_server | Microsoft | enterprise-sp1 (including) | enterprise-sp1 (including) |
| Windows_2003_server | Microsoft | enterprise-sp1_beta_1 (including) | enterprise-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | enterprise_64-bit (including) | enterprise_64-bit (including) |
| Windows_2003_server | Microsoft | enterprise_64-bit-sp1 (including) | enterprise_64-bit-sp1 (including) |
| Windows_2003_server | Microsoft | enterprise_64-bit-sp1_beta_1 (including) | enterprise_64-bit-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | enterprise_edition-sp1 (including) | enterprise_edition-sp1 (including) |
| Windows_2003_server | Microsoft | enterprise_edition-sp1_beta_1 (including) | enterprise_edition-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | enterprise_edition_64-bit (including) | enterprise_edition_64-bit (including) |
| Windows_2003_server | Microsoft | enterprise_edition_64-bit-sp1 (including) | enterprise_edition_64-bit-sp1 (including) |
| Windows_2003_server | Microsoft | enterprise_edition_64-bit-sp1_beta_1 (including) | enterprise_edition_64-bit-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | itanium (including) | itanium (including) |
| Windows_2003_server | Microsoft | r2 (including) | r2 (including) |
| Windows_2003_server | Microsoft | r2-sp1 (including) | r2-sp1 (including) |
| Windows_2003_server | Microsoft | r2-sp1_beta_1 (including) | r2-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | sp1 (including) | sp1 (including) |
| Windows_2003_server | Microsoft | standard (including) | standard (including) |
| Windows_2003_server | Microsoft | standard-sp1 (including) | standard-sp1 (including) |
| Windows_2003_server | Microsoft | standard-sp1_beta_1 (including) | standard-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | standard_64-bit (including) | standard_64-bit (including) |
| Windows_2003_server | Microsoft | web (including) | web (including) |
| Windows_2003_server | Microsoft | web-sp1 (including) | web-sp1 (including) |
| Windows_2003_server | Microsoft | web-sp1_beta_1 (including) | web-sp1_beta_1 (including) |
| Windows_xp | Microsoft | * | * |
| Windows_xp | Microsoft | ibm_oem_version (including) | ibm_oem_version (including) |
| Windows_xp | Microsoft | ibm_oem_version-sp1 (including) | ibm_oem_version-sp1 (including) |
References
- http://securityreason.com/securityalert/1186
- http://www.securityfocus.com/archive/1/439153/100/0/threaded
- http://www.securityfocus.com/archive/1/439660/100/200/threaded
- http://www.securityfocus.com/bid/18838
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27567
- http://securityreason.com/securityalert/1186
- http://www.securityfocus.com/archive/1/439153/100/0/threaded
- http://www.securityfocus.com/archive/1/439660/100/200/threaded
- http://www.securityfocus.com/bid/18838
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27567