MS03-001: Unchecked Buffer in the Locator Service Might Permit Code to Run (810833)


The information in this article applies to:

  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Server
  • Microsoft Windows NT Server 4.0 Terminal Server Edition
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Workstation 4.0

SYMPTOMS

The Microsoft Locator service is a name service that maps logical names to network-specific names. It is included with Windows NT 4.0, Windows 2000, and Windows XP.

By default, the Locator service is enabled only on Windows 2000-based domain controllers and Windows NT 4.0-based domain controllers. The Locator service is not enabled on Windows NT 4.0-based workstations or member servers, Windows 2000-based workstations or member servers, or Windows XP. A security vulnerability results from an unchecked buffer in the Locator service. By sending a specially malformed request to the Locator service, an attacker might cause the Locator service to stop working, or to run code on your computer.

RESOLUTION

For more information about how to resolve this vulnerability, click any of the following links:

Windows XP (All Versions)

Download Information

The following files are available for download from the Microsoft Download Center:
Windows XP Home Edition and Professional

All languages: DownloadDownload the 810833 package now

Windows XP 64-bit Edition

All languages: DownloadDownload the 810833 package now

Release Date: January 22, 2003

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to Obtain Microsoft Support Files from Online Services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

You can apply this update to the released version of Windows XP or to Windows XP Service Pack 1 (SP1). You must restart your computer after you apply this update. This update supports the following Setup switches:
  • /? : Display the list of installation switches.
  • /u : Use unattended mode.
  • /f : Force other programs to quit when the computer shuts down.
  • /n : Do not back up files for removal.
  • /o : Overwrite OEM files without prompting.
  • /z : Do not restart when installation is complete.
  • /q : Use Quiet mode (no user interaction).
  • /l : List installed hotfixes.
  • /x Extract the files without running Setup.
For example, to install the update without any user intervention, and then not to force the computer to restart, use the following command line:

q810833_wxp_sp2_x86_enu /u /q /z

Warning Your computer is vulnerable until you restart it.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows XP Home Edition and Windows XP Professional
   Date         Time   Version        Size    Path and File name
   -------------------------------------------------------------------------------------
   04-Dec-2002  00:55  5.1.2600.108   68,608  %Windir%\System32\Locator.exe  (pre-SP1)     
   04-Dec-2002  00:50  5.1.2600.1147  68,608  %Windir%\System32\Locator.exe  (with SP1)
Windows XP 64-Bit Edition
   Date         Time   Version        Size     File name
   --------------------------------------------------------------------------------------
   04-Dec-2002  00:55  5.1.2600.108   303,616  %Windir%\System32\Locator.exe   (pre-SP1)  
   04-Dec-2002  00:55  5.1.2600.108    68,608  %Windir%\System32\Wlocator.exe  (with SP1)
   04-Dec-2002  00:50  5.1.2600.1147  303,616  %Windir%\System32\Locator.exe   (pre-SP1) 
   04-Dec-2002  00:50  5.1.2600.1147   68,608  %Windir%\System32\Wlocator.exe  (with SP1)

Windows 2000 (All Versions) Service Pack Information

To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

Windows 2000 (All Versions) Hotfix Information

Download Information

The following files are available for download from the Microsoft Download Center:

All languages except Japanese NEC: DownloadDownload the 810833 package now
Japanese NEC: DownloadDownload the 810833 package now

Release Date: January 22, 2003

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to Obtain Microsoft Support Files from Online Services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

This update requires Windows 2000 Service Pack 2 (SP2) or Windows 2000 Service Pack 3 (SP3). For additional information about how to obtain the latest service pack, click the article number below to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

You must restart your computer after you apply this update. This update supports the following Setup switches:
  • /? : Display the list of installation switches.
  • /u : Use Unattended mode.
  • /f : Force other programs to quit when the computer shuts down.
  • /n : Do not back up files for removal.
  • /o : Overwrite OEM files without prompting.
  • /z : Do not restart when installation is complete.
  • /q : Use Quiet mode (no user interaction).
  • /l : List installed hotfixes.
  • /x : Extract the files without running Setup.
For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line:

q810833_w2k_sp4_x86_en /u /q /z

Warning Your computer is vulnerable until you restart it.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 

   Date         Time   Version        Size    File name
   ------------------------------------------------------------------------
   21-Nov-2002  21:19  5.0.2195.6136  72,464  %Windir%\System32\Locator.exe
Note Because of file dependencies, this update may contain additional files.

Windows NT 4.0 (All Versions)

Download Information

The following files are available for download from the Microsoft Download Center:

Windows NT 4.0

All languages except Japanese NEC and Chinese - Hong Kong: DownloadDownload the 810833 package now
Japanese NEC: DownloadDownload the 810833 package now
Chinese - Hong Kong: DownloadDownload the 810833 package now

Windows NT Server 4.0, Terminal Server Edition

All languages: DownloadDownload the 810833 package now

Release Date: January 22, 2003

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to Obtain Microsoft Support Files from Online Services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

This update requires Windows NT 4.0 Service Pack 6a (SP6a) or Windows NT Server 4.0, Terminal Server Edition Service Pack 6 (SP6). For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

You must restart your computer after you apply this update. This update supports the following Setup switches:
  • /y : Perform removal (only with /m or /q ).
  • /f : Force programs to be closed at shutdown.
  • /n : Do not create an Uninstall folder.
  • /z : Do not restart when update completes.
  • /q : Use Quiet or Unattended mode with no user interface (this switch is a superset of /m ).
  • /m : Use Unattended mode with user interface.
  • /l : List installed hotfixes.
  • /x : Extract the files without running Setup.
For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line:

q810833i /q /z

Warning Your computer is vulnerable until you restart it.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows NT 4.0
   Date         Time   Version        Size     File name
   -------------------------------------------------------------------------
   
   11-Dec-2002  19:33  4.0.1381.7202  119,056  %Windir%\System32\Locator.exe
Windows NT Server 4.0, Terminal Server Edition
   Date         Time   Version         Size     File name
   --------------------------------------------------------------------------

   08-Jan-2003  18:22  4.0.1381.33545  118,544  %Windir%\System32\Locator.exe
Note Because of file dependencies, this update may contain additional files.

STATUS

Windows XP (All Versions)

Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed at the beginning of this article.

Windows 2000 (All Versions)

Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Microsoft Windows 2000 Service Pack 4.

Windows NT 4.0 (All Versions)

Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

The Remote Procedure Call (RPC) Locator service (Locator.exe) is a named pipes program. Named pipes is an interprocess communication (IPC) mechanism that operates over the SMB protocol, which uses TCP ports 139 and 445. To help mitigate the risk that is associated with this security vulnerability from being exploited from the Internet, administrators can block access to these ports at the perimeter, edge router, firewall, or some combination of these. For the best protection from this vulnerability, apply the patch to all affected systems.

For more information about this vulnerability, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/MS03-001.mspx

Modification Type:MinorLast Reviewed:9/27/2005
Keywords:kbHotfixServer kbQFE kberrmsg kbWin2kSP4fix KbSECVulnerability KbSECBulletin kbSecurity KB810833
©2004 Microsoft Corporation. All rights reserved.