MS03-023: Critical Buffer Overrun in HTML Converter Allowing Code Execution

Critical Vulnerability Information Vulnerability ID: Buffer Overrun In HTML Converter Could Allow Code Execution (823559) Bulletin Number: MS03-023 Severity: Critical Release Date: July 9, 2003 Update Date: May 13, 2004 Affected Software: - Microsoft Windows 98 - Microsoft Windows 98 Second Edition - Microsoft Windows Me - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Server 4.0, Terminal Server Edition - Microsoft Windows 2000 - Microsoft Windows XP - Microsoft Windows Server 2003 Vulnerability Description: - A buffer overrun vulnerability exists in the HTML converter when improperly handling file format conversion requests. Attackers could exploit this by using specially crafted HTML pages or emails to execute arbitrary code under the context of the currently logged-on user. Mitigating Factors: - By default, Internet Explorer on Windows Server 2003 runs in Enhanced Security Configuration mode, which helps reduce the risk of automatic exploitation of this vulnerability. - In web-based attack scenarios, attackers must lure victims to specific malicious web pages, rather than forcing every user to visit them. Affected Windows Versions and Severity Levels: - Windows 98: Critical - Windows 98 Second Edition: Critical - Windows Me: Critical - Windows NT Workstation 4.0: Critical - Windows NT Server 4.0: Critical - Windows NT Server 4.0, Terminal Server Edition: Critical - Windows 2000: Critical - Windows XP: Critical - Windows Server 2003: Moderate

Goal Reached Thanks to every supporter — we hit 100%!

MS03-023: Critical Buffer Overrun in HTML Converter Allowing Code Execution