CVE-2005-2119: Medium severity Microsoft Windows 2003 Server vulnerability

Published Oct 11, 2005

Updated

The MIDLuserallocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.

Affected Software

9 affected components

Microsoft Windows 2003 Server=64-bit

Microsoft Windows 2003 Server=itanium

Microsoft Windows 2003 Server=sp1

Microsoft Windows XP

Microsoft Windows XP=sp1

Microsoft Windows 2003 Server=sp1

Microsoft Windows 2003 Server=r2

Microsoft Windows 2000=sp4

Microsoft Windows XP=sp2

Event History

Oct 11, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2119?

CVE-2005-2119 is classified as a high severity vulnerability due to the potential for arbitrary memory manipulation.

How do I fix CVE-2005-2119?

To fix CVE-2005-2119, apply the latest security updates from Microsoft for affected versions of Windows.

What systems are affected by CVE-2005-2119?

CVE-2005-2119 affects Microsoft Windows XP, Windows 2003 Server, and Windows 2000 operating systems.

What is the impact of exploiting CVE-2005-2119?

Exploiting CVE-2005-2119 can allow an attacker to overwrite arbitrary memory, potentially leading to code execution.

Is there a workaround for CVE-2005-2119?

While there are no official workarounds, limiting access to affected services may help mitigate risks associated with CVE-2005-2119.