Microsoft Windows NetDDE Remote Buffer Overflow Vulnerability

Microsoft Windows NetDDE Remote Buffer Overflow Vulnerability

Microsoft Windows NetDDE is affected by a remote buffer-overflow vulnerability because the application fails to properly verify the lengths of strings contained within unspecified network messages before copying them into finite buffers.

Note that NetDDE is not activated by default on Windows computers.

An attacker may leverage this issue to execute arbitrary code on an affected computer with SYSTEM privileges. In some circumstances, where NetDDE services have been installed but not started, local attackers might exploit this issue to gain elevated privileges because an unprivileged user may start the services.

** UPDATE: NGSSoftware has released a preliminary advisory for this issue, announcing that technical details will be withheld until January 19, 2005.

** UPDATE: Immunity Research has reported that a remote attacker may require authentication before exploiting this vulnerability. Further details of this report can be found in the referenced message "ms04-031 pre-auth ??".