Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Microsoft Windows User Shell Buffer Overflow Vulnerability

Microsoft Windows User Shell Buffer Overflow Vulnerability

by Nikola Strahija on March 12th, 2002 A buffer overflow has been discovered in the Windows user shell. The condition exists in the component of the user shell responsible for locating programs that are 'missing' to the system. 'missing' applications are those which have been registered as installed programs, but have been deleted or improperly uninstalled


Under extreme circumstances, this vulnerability may be remotely exploitable. This may be the case if an application has registered itself as an URL handler and is improperly uninstalled.

The overflow condition may be triggered in an exploitable manner if the URL handler is invoked when a specially constructed link is clicked on by a user visiting a malicious website (or reading HTML email).

When searching for the 'missing' application, the data in the URL may overwrite an activation record in the stack of the shell process.

If an attacker is aware of the registered URL-handler and can anticipate the application being 'missing', an URL containing a replacement return address and shellcode may be constructed. If a victim were to click on the link (and if the attempt is successful), arbitrary code may be executed on the client system within the security context of the user.

Remote: Yes

Solution: Microsoft has released fixes:



Microsoft Windows 2000 Advanced Server 0.0SP2:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Datacenter Server 0.0SP2:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Professional 0.0SP2:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Server 0.0SP2:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Terminal Services 0.0SP2:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Terminal Services 0.0SP1:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 98 0.0SP1:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Windows 2000 Server 0.0SP1:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Professional 0.0SP1:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Advanced Server 0.0SP1:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Datacenter Server 0.0SP1:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 98SE 0.0:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Windows 2000 Server 0.0:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Advanced Server 0.0:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 98 0.0:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Windows 2000 Professional 0.0:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Terminal Services 0.0:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows 2000 Datacenter Server 0.0:

Microsoft Patch Q313829_W2K_SP3_X86_EN
http://download.microsoft.com/download/win2000platform/Patch/Q313829/NT5/EN-US/Q313829_W2K_SP3_X86_EN.exe

Microsoft Windows NT Enterprise Server 4.0SP6a:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP6a:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP6a:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Workstation 4.0SP6a:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Workstation 4.0SP6:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP6:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Enterprise Server 4.0SP6:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP6:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP5:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Enterprise Server 4.0SP5:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP5:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Workstation 4.0SP5:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Workstation 4.0SP4:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP4:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Enterprise Server 4.0SP4:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP4:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP3:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP3:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Enterprise Server 4.0SP3:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Workstation 4.0SP3:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Workstation 4.0SP2:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP2:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Enterprise Server 4.0SP2:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP2:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Server 4.0SP1:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Enterprise Server 4.0SP1:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0SP1:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Workstation 4.0SP1:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Terminal Server 4.0:

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntterminal/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT4 Terminal Services

Microsoft Windows NT Server 4.0:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Enterprise Server 4.0:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop

Microsoft Windows NT Workstation 4.0:

Microsoft Patch Q313829
http://download.microsoft.com/download/ie4095/actdesk/4.01_sp2/W9XNT4/EN-US/q313829.exe
For NT4/Win9X Systems with Active Desktop.

Microsoft Patch Q313829i
http://download.microsoft.com/download/winntsp/Patch/Q313829/NT4/EN-US/Q313829i.exe
Windows NT 4.0 without Active Desktop


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »