The Research of the MS05039 Buffer Overflow Exploit Worm

转载于 2006-04-12 09:43:00 发布 · 1.1k 阅读

文章标签：

#buffer #microsoft #security #delete #service #windows

病毒汇编和调试逆向技术加脱壳专栏收录该内容

506 篇文章

订阅专栏

本文分析了Microsoft发布的MS05039安全公告，该漏洞存在于Plug and Play服务中，可能导致远程代码执行及权限提升。攻击者通过发送特制消息可完全控制受影响系统，安装程序、查看或修改数据。

Microsoft Security Bulletin MS05039 is vulnerability in Plug and Play that could allow remote code execution and elevation of privilege. This vulnerability was published at August 9, 2005 and was marked as critical. An unchecked buffer in the Plug and Play service causes the vulnerability. An attacker who successfully exploited this vulnerability take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. On Windows 2000, an anonymous attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to execute code

http://www.51r.com/UploadFiles/2006-4/412386684.pdf