New buffer overflow flaw in Windows Server, XP

By

Vulnerability monitoring firm Secunia has warned PC users about a buffer overflow vulnerability in Microsoft Windows Server, XP Home Edition and XP Professional.


The flaw, confirmed on a fully patched system with Windows XP and Service Pack 2 as well as Windows Server 2003, can be exploited from a remote location to cause a DoS attack on certain applications, according to Secunia.

The flaw is caused by a boundary error in inetcomm.dll within the processing of URLs with the "mhtml:" handler and can be exploited to cause a stack-based buffer overflow via an overly long URL. A user must first be tricked into visiting a malicious website with Internet Explorer or opening a malicious internet shortcut, according to Secunia.

"Successful exploitation crashed the application using the vulnerability library," warned Secunia in an advisory released last Thursday. "Execution of arbitrary code may be possible, but has currently not been proven as it is prevented by the (data execution prevention) mechanism."

Microsoft’s next Patch Tuesday release is scheduled for June 13. The Redmond, Wash., company is also working on a patch for a prevalent flaw in Microsoft Word that can be used for remote execution of malicious code.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Log In

  |  Forgot your password?