high7.5Public exploit code
CVE-2003-0717
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Windows XP/2000 - Messenger Service Buffer Overrun (MS03-043)2003-10-25 · remote · windows · Verified
- Microsoft Messenger (Linux) - Denial of Service (MS03-043)2004-08-08 · dos · windows · Verified
- Microsoft Windows Messenger Service (French) - Remote (MS03-043)2003-12-16 · remote · windows · Verified
- Microsoft Windows Messenger Service - Denial of Service (MS03-043)2003-10-18 · dos · windows · Verified
Impact
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Windows 2000 | All versions |
| Microsoft | Windows 2003 Server | Versions enterprise, enterprise_64-bit, r2, standard, web |
| Microsoft | Windows Me | All versions |
| Microsoft | Windows Nt | Version 4.0 |
| Microsoft | Windows Xp | All versions |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=106666713812158&w=2
- http://marc.info/?l=ntbugtraq&m=106632188709562&w=2
- http://www.cert.org/advisories/CA-2003-27.html
- http://www.kb.cert.org/vuls/id/575892
- http://www.securityfocus.com/bid/8826
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A213
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A268