Overview
A vulnerability in a component of some server versions of Microsoft Windows could allow a remote attacker to execute code on a vulnerable system.
Description
Microsoft's License Logging Service (LLS) assists in the management of licenses for some Microsoft server products. An error in the way that the LLS handles an unchecked buffer results in a vulnerability. An attacker with the ability to send a specially-crafted message to the LLS could exploit this vulnerability to execute code of their choosing or cause a denial of service. The specific nature of the message exploiting this vulnerability is not known. Microsoft reports that, for some affected versions of Windows, only authenticated users or programs on the local network can establish a connection to the LLS and exploit the vulnerability. These versions are
For other affected versions of Windows, any unauthenticated remote attacker may be able to connect to the LLS and exploit the vulnerability. Microsoft also notes that LLS is disabled by default in Windows Server 2003 and will not be included in future versions of the Windows operating system. |
Impact
On affected versions of Windows NT and Windows 2000 Server, a remote attacker may be able to execute arbitrary code with Local System privileges on a vulnerable system. Microsoft reports that exploitation of this vulnerability on Windows Server 2003 systems causes the License Logging Service to crash, resulting in a denial of service on that platform. |
Solution
Apply a patch |
Workarounds
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Microsoft Security for reporting this vulnerability. Microsoft, in turn, thanks Kostya Kortchinsky of CERT RENATER for reporting this issue.
This document was written by Chad R Dougherty based upon information provided by Microsoft.
Other Information
| CVE IDs: | CVE-2005-0050 |
| Severity Metric: | 10.69 |
| Date Public: | 2005-02-08 |
| Date First Published: | 2005-02-08 |
| Date Last Updated: | 2005-02-08 22:31 UTC |
| Document Revision: | 8 |