|
Sunday, 03 August 2003 |
This little bit of fine print from the Microsoft security bulletin caught my attention:
"Microsoft tested Windows Me, Windows NT 4.0, Windows NT 4.0 Terminal Services Edition, Windows 2000, Windows XP and Windows Server 2003, to assess whether they are affected by this vulnerability. Previous versions are no longer supported, and may or may not be affected by this vulnerability."
In other words, users of Windows 95, 98, 98SE, and NT Workstation are going down with the ship. There are unconfirmed reports that these systems are in fact vulnerable.
For the real geeks out there, I've done a little more digging and here's a list of the CERT references for the exploit. Or, you can go here and read the exploit source code. Looks like the root cause is improper bounds checking when copying a string into a buffer that is only supposed to be 32 bytes long (the max length of a netbios name).
Powered by AkoComment 2.0! and SecurityImage 3.0.4 |
