Microsoft Windows 2000 System Monitor ActiveX Control contains buffer overflow

Overview

There is a buffer overflow in the System Monitor ActiveX control that ships with Windows 2000.

Description

The System Monitor ActiveX control (sysmon.ocx) included with Windows 2000 contains a buffer overflow. For more information, see

<http://www.microsoft.com/technet/security/bulletin/ms00-085.asp&gt;
<http://www.ussrback.com/labs57.html&gt;

The class id for this control is C4D2D8E0-D1DD-11CE-940F-008029004347.

---

Impact

Intruders who can script the control (e.g. by constructing a malicious web page or email message) can execute arbitrary code with the privileges of the victim.

---

Solution

Apply a patch as described in the Microsoft bulletin.

---

Vendor Information

183397

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft __ Affected

Updated: May 23, 2002

Status

Affected

Vendor Statement

See <http://www.microsoft.com/technet/security/bulletin/ms00-085.asp&gt;.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23183397 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/fq00-085.asp&gt;
• <http://www.microsoft.com/technet/security/bulletin/ms00-085.asp&gt;
• <http://www.ussrback.com/labs57.html&gt;
• <http://www.securityfocus.com/bid/1899&gt;

Acknowledgements

Our thanks to Microsoft and Underground Security Systems Research and for the information contained in their advisories.

This document was written by Shawn V. Hernan.

Other Information

CVE IDs:	CVE-2000-1034
Date Public:	2000-11-02 Date First Published: