Article ID: 328310
Article Last Modified on 12/1/2007
APPLIES TO
- Microsoft Windows XP 64-Bit Edition SP1
- Microsoft Windows XP Professional x64 Edition
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Professional
- Microsoft Windows XP Professional
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows NT Server 4.0 Standard Edition
- Microsoft Windows NT 4.0 Service Pack 1
- Microsoft Windows NT 4.0 Service Pack 2
- Microsoft Windows NT 4.0 Service Pack 3
- Microsoft Windows NT 4.0 Service Pack 4
- Microsoft Windows NT 4.0 Service Pack 5
- Microsoft Windows NT 4.0 Service Pack 6
- Microsoft Windows NT 4.0 Service Pack 6a
- Microsoft Windows NT Server 4.0, Terminal Server Edition
- Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 4
- Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 5
- Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 6
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
This article was previously published under Q328310
SYMPTOMS
Windows messages provide a way for interactive processes to react to user events (such as keystrokes or mouse movements) and communicate with other interactive processes. The WM_TIMER message is sent at the expiration of a timer, and it can be used to cause a process to run a timer callback function. This message may create a security vulnerability because it is possible for one process in the interactive desktop to use a WM_TIMER message to cause another process to run a callback function at the address of its choice, even if the second process did not set a timer. If that second process has higher privileges than the first process, this would provide the first process with a way of exercising the functions.
By default, several of the processes that are running in the interactive desktop do so with LocalSystem privileges. As a result, an attacker who can log on to a system interactively can potentially run a program that would levy a WM_TIMER request upon such a process, causing it to take any action the attacker specified. In this scenario, the attacker can have complete control over the system.
The security patch that is described in this article addresses this vulnerability, and it also makes changes to several processes that run on the interactive desktop with high privileges. Although none of these processes would allow an attacker to gain privileges on the system in the absence of the WM_TIMER vulnerability, we have included them in the patch to make the services more robust.
RESOLUTION
Service pack information
Windows XP
To resolve this problem, obtain the latest service pack for Microsoft Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to obtain the latest Windows XP service pack
Windows 2000
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
Hotfix information
For more information about how to resolve this vulnerability, click any of the following links:
Windows XP (All Versions)
Download Information
The following files are available for download from the Microsoft Download Center:
Windows XP Home Edition and Professional
All languages: ![[GRAPHIC: Download]](/wiki/index.php?title=File:Download.gif){kind=small}
Download the 328310 package now
Windows XP 64-bit Edition
All languages: Download the 328310 package now
Release Date: December 11, 2002
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
Installation Information
This update can be applied to the RTM version of Windows XP or to Windows XP Service Pack 1 (SP1). You must restart your computer after you apply this update. This update supports the following Setup switches:
- /? : Display the list of installation switches.
- /u : Use unattended mode.
- /f : Force other programs to quit when the computer shuts down.
- /n : Do not back up files for removal.
- /o : Overwrite OEM files without prompting.
- /z : Do not restart when installation is complete.
- /q : Use Quiet mode (no user interaction).
- /l : List installed hotfixes.
- /x Extract the files without running Setup.
For example, to install the update without any user intervention, and then not to force the computer to restart, use the following command line:
q328310_wxp_sp2_x86_enu /u /q /z
Warning Your computer is vulnerable until you restart it.
File Information
The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
The following files are copied to the %WINDIR%\System32 folder.
Windows XP Home Edition and Windows XP Professional
Date Time Version Size File name ----------------------------------------------------------------------- 08-Oct-2002 20:19 1,053,822 Sysmain.sdb (pre-SP1) 22-Nov-2002 17:16 5.1.2600.104 528,896 User32.dll (pre-SP1) 21-Oct-2002 22:45 5.1.2600.104 1,671,168 Win32k.sys (pre-SP1) 22-Nov-2002 17:16 5.1.2600.104 272,384 Winsrv.dll (pre-SP1) 01-Nov-2002 19:13 1,080,070 Sysmain.sdb (with SP1) 01-Nov-2002 20:26 5.1.2600.1134 528,896 User32.dll (with SP1) 23-Oct-2002 13:55 5.1.2600.1134 1,694,336 Win32k.sys (with SP1) 01-Nov-2002 20:26 5.1.2600.1134 272,896 Winsrv.dll (with SP1)
Windows XP 64-Bit Edition
Date Time Version Size File name ---------------------------------------------------------------------- 08-Oct-2002 20:19 1,053,822 Sysmain.sdb (pre-SP1) 22-Nov-2002 17:16 5.1.2600.104 1,480,704 User32.dll (pre-SP1) 21-Oct-2002 22:45 5.1.2600.104 5,534,208 Win32k.sys (pre-SP1) 22-Nov-2002 17:16 5.1.2600.104 823,808 Winsrv.dll (pre-SP1) 08-Oct-2002 20:19 1,053,822 Wsysmain.sdb (pre-SP1) 21-Oct-2002 22:40 5.1.2600.104 555,520 Wuser32.dll (pre-SP1) 01-Nov-2002 18:52 1,085,382 Sysmain.sdb 01-Nov-2002 20:26 5.1.2600.1134 1,481,728 User32.dll (with SP1) 23-Oct-2002 13:55 5.1.2600.1134 5,621,888 Win32k.sys (with SP1) 01-Nov-2002 20:26 5.1.2600.1134 824,320 Winsrv.dll (with SP1) 01-Nov-2002 19:13 1,080,070 Wsysmain.sdb (with SP1) 23-Oct-2002 13:57 5.1.2600.1134 556,032 Wuser32.dll (with SP1)
Windows 2000 (All Versions) Hotfix Information
Download Information
The following files are available for download from the Microsoft Download Center:
All languages except Japanese NEC:
Japanese NEC:
Release Date: December 11, 2002
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
Installation Information
This update requires Windows 2000 Service Pack 1 (SP1), Windows 2000 Service Pack 2 (SP2), or Windows 2000 Service Pack 3 (SP3). For additional information about how to obtain the latest service pack, click the article number below to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
You must restart your computer after you apply this update. This update supports the following Setup switches:
- /? : Display the list of installation switches.
- /u : Use Unattended mode.
- /f : Force other programs to quit when the computer shuts down.
- /n : Do not back up files for removal.
- /o : Overwrite OEM files without prompting.
- /z : Do not restart when installation is complete.
- /q : Use Quiet mode (no user interaction).
- /l : List installed hotfixes.
- /x : Extract the files without running Setup.
For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line:
q328310_w2k_sp4_x86_en /u /q /z
Warning Your computer is vulnerable until you restart it.
File Information
The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
The following files are copied to the %WINDIR%\System32 folder:
Date Time Version Size File name --------------------------------------------------------------- 01-Nov-2002 21:33 5.0.2195.5265 42,256 Basesrv.dll 01-Nov-2002 21:33 5.0.2195.5907 222,992 Gdi32.dll 01-Nov-2002 21:33 5.0.2195.6079 708,880 Kernel32.dll 01-Nov-2002 21:33 5.0.2195.6090 332,560 Msgina.dll 01-Nov-2002 21:33 5.0.2195.6097 379,664 User32.dll 01-Nov-2002 21:33 5.0.2195.6085 370,448 Userenv.dll 21-Oct-2002 13:26 5.0.2195.6097 1,643,248 Win32k.sys 29-Oct-2002 15:59 5.0.2195.6108 179,472 Winlogon.exe 01-Nov-2002 21:33 5.0.2195.6097 243,472 Winsrv.dll
Note Because of file dependencies, this update may contain additional files.
Windows NT 4.0 (All Versions)
Download Information
The following files are available for download from the Microsoft Download Center:
Windows NT 4.0
All languages except Japanese NEC and Chinese - Hong Kong:
Japanese NEC:
Chinese - Hong Kong:
Windows NT Server 4.0, Terminal Server Edition
All languages:
Release Date: December 11, 2002
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
Installation Information
This update requires Windows NT 4.0 Service Pack 6a (SP6a) or Windows NT Server 4.0, Terminal Server Edition Service Pack 6 (SP6). For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack
You must restart your computer after you apply this update. This update supports the following Setup switches:
- /y : Perform removal (only with /m or /q ).
- /f : Force programs to be closed at shutdown.
- /n : Do not create an Uninstall folder.
- /z : Do not restart when update completes.
- /q : Use Quiet or Unattended mode with no user interface (this switch is a superset of /m ).
- /m : Use Unattended mode with user interface.
- /l : List installed hotfixes.
- /x : Extract the files without running Setup.
For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line:
Q328310i /q /z
Warning Your computer is vulnerable until you restart it.
The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
The following files are copied to the %WINDIR%\System32 folder.
Windows NT 4.0
Date Time Version Size File name -------------------------------------------------------------- 30-Dec-2002 22:12 4.0.1381.7177 169,744 Gdi32.dll 30-Dec-2002 22:12 4.0.1381.7202 326,928 User32.dll 30-Dec-2002 22:12 4.0.1381.7202 175,888 Winsrv.dll 30-Jan-2003 17:57 4.0.1381.7207 1,255,024 Win32k.sys
Windows NT Server 4.0, Terminal Server Edition
Date Time Version Size File name -------------------------------------------------------------- 05-Apr-2002 23:38 4.0.1381.33535 170,256 Gdi32.dll 11-Nov-2002 22:09 4.0.1381.33544 332,048 User32.dll 11-Nov-2002 22:09 4.0.1381.33544 196,368 Winsrv.dll 24-Feb-2003 15:10 4.0.1381.33546 1,280,048 Win32k.sys
Note Because of file dependencies, this update may contain additional files.
STATUS
Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed in the "Applies to" section.
Windows XP
This problem was first corrected in Microsoft Windows XP Service Pack 2.
Windows 2000
This problem was first corrected in Microsoft Windows 2000 Service Pack 4.
MORE INFORMATION
For more information about this vulnerability, visit the following Microsoft Web site:
Additional query words: security_patch browser hang Internet Explorer Windows Explorer
Keywords: kbhotfixserver kbqfe atdownload kbwinxpsp2fix kbenv kbsecurity kbwin2ksp4fix kbwinxppresp2fix kbbug kbfix kbwin2000presp4fix KB328310
