Now Showing: MS05-047 Exploit In-The-Wild

["Fergie (Paul Ferguson)" <fergdawg () netzero net>]

That's right. You should've been patched, like, yesterday.

Personally, I expect to see a worm which uses this exploit to begin circulating within the next few days.

Via FrSIRT.

[snip]

Microsoft Windows Plug and Play "Umpnpmgr.dll" Remote Exploit (MS05-047)

Exploits this advisory:

Advisory ID : FrSIRT/ADV-2005-2044
CVE ID : CVE-2005-2120
Rated as : High Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-10-11

* Technical Description *

A vulnerability has been identified in Microsoft Windows, which may be exploited by attackers to execute abitrary 
commands or by malicious users to obtain elevated privileges. This issue is due to a buffer overflow error in the Plug 
and Play (PnP) service that does not properly validate user supplied data to the functions "PNP_GetDeviceList" and 
"PNP_GetDeviceListSize", which could be exploited by attackers to execute arbitrary commands.

Note : On Windows 2000 and Windows XP SP1, an authenticated user could remotely exploit this vulnerability, however, in 
certain Windows XP configurations, anonymous users could authenticate and exploit this vulnerability as the Guest 
account. On Windows XP SP2, only an administrator can remotely access the affected component. Therefore, on Windows XP 
SP2, this issue is strictly a local privilege elevation vulnerability.

* Affected Products *

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 1
Microsoft Windows XP Service Pack 2

* Solution *

Apply patches :
http://www.microsoft.com/technet/security/Bulletin/MS05-047.mspx

[snip]

http://www.frsirt.com/english/advisories/2005/2044

- ferg


--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg () netzero net or fergdawg () sbcglobal net
 ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.