Mark Litchfield has reported a vulnerability in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the handling of messages. This can be exploited by tricking a user into connecting to a malicious WebDAV service and sending specially crafted messages via WebDAV to the Web Client Service.
OPERATING SYSTEM:
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
SOLUTION:
Apply patches.
Microsoft Windows XP (requires Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91488DDD-1D7E-4277-916A-D5F2EE0B6327
Microsoft Windows XP 64-Bit Edition (requires Service Pack 1)
(Itanium):
http://www.microsoft.com/downloads/details.aspx?FamilyId=1DC37A74-BF1E-4AFE-8198-D5CA460A3872
Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2024382A-14A9-4231-8835-E2720C562190
Microsoft Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=B7097610-8AAB-4A2F-94C9-18D32E1C297C
Microsoft Windows Server 2003 (Itanium):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2024382A-14A9-4231-8835-E2720C562190
PROVIDED AND/OR DISCOVERED BY:
Mark Litchfield of Next Generation Security Software.
ORIGINAL ADVISORY:
MS05-028 (KB896426):
http://www.microsoft.com/technet/security/Bulletin/MS05-028.mspx
VERIFY ADVISORY:
http://secunia.com/advisories/15696/
Secunia Security Advisories
http://community.securityteam.us/article.php/20050615073359795