CVE-2003-0806

Vulnerability

A buffer overflow exists in the Windows logon process (winlogon.exe) on Microsoft Windows NT 4.0 Service Pack 6a, Windows 2000 Service Pack 2 through Service Pack 4, and Windows XP Service Pack 1 (including 64-Bit Edition) when the system is a member of a domain [1][2]. The flaw occurs during processing of the domain value supplied as part of a logon request; Winlogon fails to validate the size of this domain string before copying it into a fixed-size buffer [2]. Systems that are not domain members are not affected [2].

Exploitation

An attacker must first have permission to modify user objects in the domain, such as membership in the Administrators or Account Operators groups (or a user account to whom such permission has been delegated) [2]. The attack is initiated from a remote machine by sending a specially crafted logon request with an overly long domain value to a domain controller or member server running the affected software [1][2]. No user interaction on the target is required beyond the normal logon process.

Impact

Successful exploitation allows the attacker to execute arbitrary code with System privileges, leading to complete compromise of the confidentiality, integrity, and availability of the affected system [1][2]. The attacker gains full control over the target machine, which could then be used to pivot further within the domain.

Mitigation

Microsoft released security update MS04-011 (Knowledge Base Article 835732) in April 2004 to address this vulnerability [1]. Affected users should apply the appropriate patch for their Windows version immediately. For Windows NT Server 4.0 Terminal Server Edition Service Pack 6, the Security Rollup Package (SRP) must be installed first [1]. No workaround is provided for unpatched systems; remaining unpatched systems are still at risk. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.