Title: Windows 2000 Event Viewer Contains Unchecked Buffer
Date: February 26, 2001
Software: Windows 2000
Impact: Run code of attacker's choice
Bulletin: MS01-013
The Windows 2000 event viewer snap-in has an unchecked buffer in a
section of the code that displays the detailed view of event records.
If the event viewer attempted to display an event record that
contained specially malformed data in one of the fields, either of
two outcomes would result. In the less serious case, the event viewer
would fail. In the more serious case, code of the attacker's choice
could be made to run via a buffer overrun.
By design, unprivileged processes can log events in the System and
Application logs, and interactively logged-on, unprivileged users can
view them. However, only privileged processes can log events in the
Security log, and only interactively logged-on administrators can
view them. If the vulnerability were exploited to run code of the
attacker's choice, the code would run in the security context of the
user who viewed the affected record.
Blake Watts of Guardent (http://www.guardent.com)
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.