CVE-2005-1985

An anonymous remote attacker can send a specially crafted network message to a system running the Client Service for NetWare (CSNW) [ref_id=1]. The unchecked buffer in CSNW fails to validate the length of the message before passing it to the allocated buffer, leading to memory corruption [ref_id=1]. On most affected platforms, no authentication is required; on Windows Server 2003 SP1, the attacker must have valid logon credentials and local access [ref_id=1]. The vulnerability can be exploited over TCP ports 139 and 445, or over other installed protocols such as IPX/SPX [ref_id=1].

The advisory does not specify particular function names or file paths. The vulnerable component is the Client Service for NetWare (CSNW), also called Gateway Service for NetWare on Windows 2000 Server [ref_id=1]. The advisory states the bug is an "unchecked buffer" in this service [ref_id=1].

The security update removes the vulnerability by modifying the way CSNW validates the length of a message before passing it to the allocated buffer [ref_id=1]. This ensures that crafted messages exceeding the buffer size are rejected rather than causing memory corruption. The advisory does not include a code-level patch diff, but describes the fix as a length-validation correction in the affected component [ref_id=1].