{"vuid":"VU#388900","idnumber":"388900","name":"Microsoft Web Client Service vulnerable to buffer overflow","keywords":["Microsoft","Windows","remote code execution","Web Client","MS06-008","buffer overflow","WebDAV"],"overview":"A buffer overflow in the message handling routines of the Microsoft Web Client Service may allow a remote, authenticated attacker to execute arbitrary code on a vulnerable system.","clean_desc":"According to Microsoft,  the Web Client Service: allows applications to access documents on the Internet. Web Client extends the networking capability of Windows by allowing standard Win32 applications to create, read, and write files on Internet file servers by using the WebDAV protocol. The WebDAV protocol is a file-access protocol that is described in XML and that travels over the Hypertext Transfer Protocol (HTTP). By using standard HTTP, WebDAV runs over the existing Internet infrastructure. For example, WebDAV runs over firewalls and routers. The Web Client Service (WebClnt.dll) does not properly validate incoming messages, potentially allowing a buffer overflow to occur. If a remote, authenticated attacker sends a specially crafted message to a vulnerable system, they may be able to trigger the buffer overflow. The Web Client Service is disabled by default on Windows Server 2003, but may be enabled by default in Microsoft Windows XP. For more information about affected components, please refer to MS06-008. This Bulletin supplants Microsoft Security Bulletin MS05-028.","impact":"A remote attacker with valid login credentials may be able to exploit this vulnerability to execute arbitrary code.","resolution":"Apply An Update \nMicrosoft has addressed this issue in Microsoft Security Bulletin MS06-008","workarounds":"Please see Microsoft Security Bulletin MS06-009 for a list of workarounds to mitigate this vulnerability.","sysaffected":"","thanks":"This vulnerability was reported in Microsoft Security Bulletin \nMS06-008\n. Microsoft credits  \nKostya Kortchinsky of \nEADS/CRC\n with providing information regarding this issue.","author":"This document was written by Jeff Gennari.","public":["http://www.microsoft.com/technet/security/bulletin/ms06-008.mspx","http://www.microsoft.com/technet/security/Bulletin/MS05-028.mspx"],"cveids":["CVE-2006-0013"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-02-14T18:41:47Z","publicdate":"2006-02-14T00:00:00Z","datefirstpublished":"2006-02-14T21:36:31Z","dateupdated":"2006-02-14T21:37:45Z","revision":17,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"11","cam_impact":"17","cam_easeofexploitation":"9","cam_attackeraccessrequired":"10","cam_scorecurrent":"5.680125","cam_scorecurrentwidelyknown":"7.2579375","cam_scorecurrentwidelyknownexploited":"13.5691875","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":5.680125,"vulnote":null}