Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.

The remote version of Windows contains a flaw in the function 'DsRolerUpgradeDownlevelServer' of the Local Security Authority Server Service (LSASS) that allows an attacker to execute arbitrary code on the remote host with SYSTEM privileges.

A series of worms (Sasser) are known to exploit this vulnerability in the wild.

The remote host is missing a critical Microsoft Windows Security Update (835732).

This update fixes various flaws that could allow an attacker to execute arbitrary code on the remote host.

A series of worms (Sasser) are known to exploit this vulnerability in the wild.

ID	Name	Product	Family	Severity
12209	MS04-011: Security Update for Microsoft Windows (835732) (uncredentialed check)	Nessus	Windows	critical
12205	MS04-011: Microsoft Hotfix (credentialed check) (835732)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2003-0533

high

Tenable Plugins

critical

critical