-----BEGIN PGP SIGNED MESSAGE-----
Title: Flaw in Windows Function Could Allow Denial of Service (823803) Date: 23 July 2003 Software: Microsoft Windows NT 4.0 Server Impact: Denial of service Max Risk: Moderate Bulletin: MS03-029
Microsoft encourages customers to review the Security Bulletins at: http://www.microsoft.com/technet/security/bulletin/MS03-029.asp http://www.microsoft.com/security/security_bulletins/ms03-029.asp
A flaw exists in a Windows NT 4.0 Server file management function that can cause a denial of service vulnerability. The flaw results because the affected function can cause memory that it does not own to be freed when a specially crafted request is passed to it. If the application making the request to the function does not carry out any user input validation and allows the specially crafted request to be passed to the function, the function may free memory that it does not own. As a result, the application passing the request could fail.
By default, the affected function is not accessible remotely, however applications installed on the operating system that are available remotely may make use of the affected function. Application servers or Web servers are two such applications that may access the function. Note that Internet Information Server 4.0 (IIS 4.0) does not, by default, make use of the affected function.
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
-----BEGIN PGP SIGNATURE----- Version: PGP 7.1
iQEVAwUBPx3d1Y0ZSRQxA/UrAQEbYwf/Z9906V/XwCHzRaqubU7b53GlGkI2rT7G itmiuwmsN/49PyQT5nw7AY8ycXaeHaHNWRXQ9BEL82hyEdPTgCutkz9dq1/4A/OD oyOel0hUJglKWD7bRwmOYpcNYniswWErm5LiTCYJ+8AVSuLwQuklCjo0a7UpCkyW ZVAzLc39SwZYIIEfz4JsbZTKtG7x7ZIKkt/EeZpk2BNLRZiSEww3EFKmhsOKm2KJ 6hcephJ2ptnXUoxpjzuvHdjm20Jeriw82fkWayqhZgYpATTagdhz1gmZscuws6Cg efsFXSISCP7UUhYsjOaf8yjsWDu1m5m9HaMwYKorm6IVQ/wuEssUCg== =2SLA -----END PGP SIGNATURE-----
You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service. For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.
To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.
To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp
If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below: Reply to this message with the word UNSUBSCRIBE in the Subject line.
For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.