PUBLISHED DATE: June 9, 2003CVE-2003-0227:
Denial of Service Vulnerability

Description

The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.

Products

• Microsoft Windows 2000
• Microsoft Windows 2000 Japanese Server Edition
• Microsoft Windows 2000 Advanced Server Edition
• Microsoft Windows 2000 Datacenter Server Edition
• Microsoft Windows 2000 Professional Edition
• Microsoft Windows 2000 Server Edition
• Microsoft Windows 2000 Beta 3
• Microsoft windows 2000_gold
• Microsoft Windows 2000 Addvanced Server (Initial Release)
• Microsoft Windows 2000 Datacenter Server (Initial Release)
• Microsoft Windows 2000 Professional (Initial release)
• Microsoft Windows 2000 Server (Inital release)
• Microsoft windows 2000_rc1
• Microsoft windows 2000_rc2
• Microsoft windows 2000_sp1
• Microsoft Windows 2000 Service Pack 1 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 1 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 1 Professional Edition
• Microsoft Windows 2000 Service Pack 1 Server Edition
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Server SP1
• Microsoft windows 2000_sp2
• Microsoft Windows 2000 Service Pack 2 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 2 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 2 Professional Edition
• Microsoft Windows 2000 Service Pack 2 Server Edition
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Server SP2
• Microsoft windows 2000_sp3
• Microsoft Windows 2000 Service Pack 3 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 3 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 3 Professional Edition
• Microsoft Windows 2000 Service Pack 3 Server Edition
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Datacenter Server SP3
• Microsoft Windows 2000 Professional SP3
• Microsoft Windows 2000 Server SP3
• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows 2000 Service Pack 4 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 4 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 4 Professional Edition
• Microsoft Windows 2000 Service Pack 4 Server Edition
• Microsoft Windows 2000 Service Pack 4 French
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Microsoft Windows NT 4.0
• Microsoft Windows NT 4.0 Embedded Edition x64
• Microsoft Windows NT 4.0 Embedded Edition x86
• Microsoft Windows NT 4.0 Enterprise Edition x64
• Microsoft Windows NT 4.0 Enterprise Edition x86
• Microsoft Windows NT 4.0 Server Edition x64
• Microsoft Windows NT 4.0 Server Edition x86
• Microsoft Windows NT 4.0 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Workstation Edition x64
• Microsoft Windows NT 4.0 Workstation Edition x86
• Microsoft Windows 4.0 gold
• Microsoft Windows 4.0 gold embedded
• Microsoft Windows 4.0 gold enterprise
• Microsoft Windows 4.0 gold server
• Microsoft Windows NT 4.0 Terminal Server Edition (Initial release)
• Microsoft Windows 4.0 gold workstation
• Microsoft Windows 4.0 sp1
• Microsoft Windows NT 4.0 Service Pack 1 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 1 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 1 Workstation Edition x86
• Microsoft Windows 4.0 sp1 embedded
• Microsoft Windows 4.0 sp1 enterprise
• Microsoft Windows 4.0 sp1 server
• Microsoft Windows NT Terminal Server 4.0 SP1
• Microsoft Windows 4.0 sp1 workstation
• Microsoft Windows 4.0 sp2
• Microsoft Windows NT 4.0 Service Pack 2 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 2 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 2 Workstation Edition x86
• Microsoft Windows 4.0 sp2 embedded
• Microsoft Windows 4.0 sp2 enterprise
• Microsoft Windows 4.0 sp2 server
• Microsoft Windows NT Terminal Server 4.0 SP2
• Microsoft Windows 4.0 sp2 workstation
• Microsoft Windows 4.0 sp3
• Microsoft Windows NT 4.0 Service Pack 3 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 3 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 3 Workstation Edition x86
• Microsoft Windows 4.0 sp3 embedded
• Microsoft Windows 4.0 sp3 enterprise
• Microsoft Windows 4.0 sp3 server
• Microsoft Windows NT Terminal Server 4.0 SP3
• Microsoft Windows 4.0 sp3 workstation
• Microsoft Windows 4.0 sp4
• Microsoft Windows NT 4.0 Service Pack 4 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 4 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 4 Workstation Edition x86
• Microsoft Windows 4.0 sp4 embedded
• Microsoft Windows 4.0 sp4 enterprise
• Microsoft Windows 4.0 sp4 server
• Microsoft Windows NT Terminal Server 4.0 SP4
• Microsoft Windows 4.0 sp4 workstation
• Microsoft Windows 4.0 sp5
• Microsoft Windows NT 4.0 Service Pack 5 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 5 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 5 Workstation Edition x86
• Microsoft Windows 4.0 sp5 embedded
• Microsoft Windows 4.0 sp5 enterprise
• Microsoft Windows 4.0 sp5 server
• Microsoft Windows NT Terminal Server 4.0 SP5
• Microsoft Windows 4.0 sp5 workstation
• Microsoft Windows 4.0 sp6
• Microsoft Windows NT 4.0 Service Pack 6 Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6 Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 6 Workstation Edition x86
• Microsoft Windows 4.0 sp6 embedded
• Microsoft Windows 4.0 sp6 enterprise
• Microsoft Windows 4.0 sp6 server
• Microsoft Windows NT Terminal Server 4.0 SP6
• Microsoft Windows 4.0 sp6 workstation
• Microsoft Windows 4.0 sp6a
• Microsoft Windows NT 4.0 Service Pack 6a Embedded Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Embedded Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Enterprise Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Enterprise Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Terminal Server Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Terminal Server Edition x86
• Microsoft Windows NT 4.0 Service Pack 6a Workstation Edition x64
• Microsoft Windows NT 4.0 Service Pack 6a Workstation Edition x86
• Microsoft Windows 4.0 sp6a embedded
• Microsoft Windows 4.0 sp6a enterprise
• Microsoft Windows 4.0 sp6a server
• Microsoft Windows NT Terminal Server 4.0 SP6a
• Microsoft Windows 4.0 sp6a workstation
• Microsoft Windows NT 4.0 Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Embedded Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Enterprise Edition Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Server Post Service Pack 6a Security Rollup
• Microsoft Windows NT 4.0 Service Roll-up Terminal Server
• Microsoft Windows NT 4.0 Workstation Post Service Pack 6a Security Rollup

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2003-0227, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2003-0227 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• http://webappsec.pbworks.com/Buffer-Overflow
• https://capec.mitre.org/data/definitions/10.html
• https://capec.mitre.org/data/definitions/100.html
• https://capec.mitre.org/data/definitions/123.html
• https://capec.mitre.org/data/definitions/14.html
• https://capec.mitre.org/data/definitions/24.html
• https://capec.mitre.org/data/definitions/42.html
• https://capec.mitre.org/data/definitions/44.html
• https://capec.mitre.org/data/definitions/45.html
• https://capec.mitre.org/data/definitions/46.html
• https://capec.mitre.org/data/definitions/47.html
• https://capec.mitre.org/data/definitions/8.html
• https://capec.mitre.org/data/definitions/9.html
• https://nvd.nist.gov/vuln/detail/CVE-2003-0227