CVE-2003-1544: Windows 2000 Terminal Server DoS via MSGINA.DLL Lock

Key Information Summary Vulnerability Type: DoS attack on Windows 2000 Terminal Server CVE ID: CVE-2003-1544 CVSS Base Score: 6.8/10 Risk Level: Low Local Exploitability: Yes Remote Exploitability: No CVSS Impact Subscore: 6.9/10 - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Complete CVSS Exploitability Subscore: 8/10 - Attack Complexity: Low - Authentication: Single time Description Any user with sufficient privileges to log into a Windows 2000 Terminal Server (via RDP or ICA) and access its file system can arbitrarily restart the server. Exploitation Steps 1. Open with exclusive access (read lock). This can be done using Radsoft's HEXVIEW.EXE from Rix2K. 2. Establish a new connection to the server via RDP/ICA. 3. Click the "Restart" button in the pop-up warning dialog box, which displays the error message “msgina.dll failed to load”. Mitigation Remove all permissions for MSGINA.DLL from “Power Users”, “Users”, and “Everyone”. Note: The above mitigation has been tested on Windows 2000 Server (IE55, SP2), and users can still log in normally. If Microsoft ever requires MSGINA.DLL to be accessible to regular users, alternative fixes would need to be developed. Vendor Status Contacted on January 16, 2003; responded the next day requesting additional time for investigation, with no further response since. Acknowledgments Thanks to PPH for providing the Windows 2000 Server IE55, SP2 machine.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2003-1544: Windows 2000 Terminal Server DoS via MSGINA.DLL Lock