CVE-2005-2120

An authenticated attacker sends a specially crafted network message containing an excessive number of backslash characters in a registry key name to the Plug and Play service on a target system. The PnP service passes this oversized input to `wsprintfW` without proper length validation, causing a stack-based buffer overflow [ref_id=1]. On Windows 2000 and XP SP1, authenticated remote users can trigger this; on XP SP2, only local administrative users can reach the vulnerable component [ref_id=1].

The vulnerability resides in the Plug and Play (PnP) service, specifically in the UMPNPMGR.DLL module. The flaw is a stack-based buffer overflow triggered in a `wsprintfW` function call when processing registry key names containing a large number of backslash (`\`) characters [ref_id=1].

The security update modifies the Plug and Play service to properly validate the length of a message before passing it to the allocated buffer [ref_id=1]. By adding bounds checking on the registry key name input, the fix prevents the oversized backslash string from overflowing the stack buffer in the `wsprintfW` call [ref_id=1].

The bundle includes a reference to a public exploit at http://www.securityfocus.com/bid/15065, but no reproduction steps are provided in the reference write-ups or exploit references. Therefore, specific reproduction steps cannot be reconstructed from the available information.