bugtraq - (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow (Universal Exploit + no crash shellcode)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E1E3afM-0006qS-00.houseofdabus-inbox-ru@f15.mail.ru>
Date: Fri, 12 Aug 2005 18:37:48 +0400
From: houseofdabus <houseofdabus@...ox.ru>
To: Bugtraq@...urityfocus.com
Subject: (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow (Universal Exploit + no crash shellcode)

(MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow (Universal Exploit + no crash shellcode)

exploit attached.

Description:
A remote code execution and local elevation of privilege
vulnerability exists in Plug and Play that could allow an
attacker who successfully exploited this vulnerability to take
complete control of the affected system.

This is a remote code execution and local privilege elevation
vulnerability. On Windows 2000, an anonymous attacker could
remotely try to exploit this vulnerability.

On Windows XP Service Pack 1, only an authenticated user could
remotely try to exploit this vulnerability.
On Window XP Service Pack 2 and Windows Server 2003, only an
administrator can remotely access the affected component.
Therefore, on Windows XP Service Pack 2 and Windows Server 2003,
this is strictly a local privilege elevation vulnerability.
An anonymous user cannot remotely attempt to exploit this
vulnerability on Windows XP Service Pack 2 and Windows
Server 2003.

Solution:
    http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx

View attachment "HOD-ms05039-pnp-expl.c" of type "text/plain" (14698 bytes)