CVE-2005-1983

On Windows 2000, an anonymous attacker can send a specially crafted packet to the affected system over the network, targeting TCP ports 139 or 445 [ref_id=1]. On Windows XP Service Pack 1, the attacker must be authenticated but can still send the malicious packet remotely. On Windows XP Service Pack 2 and Windows Server 2003, only a locally logged-on user (with administrative rights on Server 2003) can exploit the vulnerability by running a specially crafted application [ref_id=1]. The unchecked buffer in the PnP service overflows when processing the crafted input, allowing arbitrary code execution.

The vulnerability resides in the Plug and Play (PnP) service, specifically an unchecked buffer within the service's handling of incoming messages [ref_id=1]. The advisory does not name a specific function or file path.

The security update corrects the vulnerability by ensuring the Plug and Play service properly validates the length of incoming messages before copying them into a buffer [ref_id=1]. No patch diff is included in the bundle; the advisory states that applying the update eliminates the unchecked buffer condition [ref_id=1].