Select the product you need help with
MS03-013: Buffer overrun in Windows kernel message handling could lead to elevated privilegesArticle ID: 811493 - View products that this article applies to. May 28, 2003: Microsoft released an updated patch for
Windows XP Service Pack 1 (SP1). This revised patch corrects the performance
issues that some customers experienced with the original Windows XP Service
Pack 1 patch. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 819634
(http://support.microsoft.com/kb/819634/
)
You may experience performance issues after you install the 811493 (MS03-013) security update
On This PageSYMPTOMSThe Windows kernel is the core of the operating system. It
provides system level services such as device and memory management, allocates
processor time to processes, and manages error handling. There is a flaw in the
way the kernel passes error messages to a debugger. This flaw causes a
vulnerability. An attacker could write a program to exploit this flaw and run
code of their choice. An attacker could exploit this vulnerability to take any
action on the system including deleting data, adding accounts with
administrative access, or reconfiguring the system. For an attack to be successful, an attacker would have to be able to log on interactively to the system, either at the console or through a terminal session. Also, a successful attack would require the introduction of code to exploit this vulnerability. Security Best Practices resources recommend that you restrict the ability to log on interactively on servers. As a result, this issue most directly affects client systems and terminal servers. For more information about Security Best Practices resources, visit the following Microsoft Web site: http://www.microsoft.com/security/guidance/default.mspx Mitigating Factors
(http://www.microsoft.com/security/guidance/default.mspx)
RESOLUTIONService Pack InformationWindows XPTo resolve this problem, obtain the latest service pack for Microsoft Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:322389
(http://support.microsoft.com/kb/322389/EN-US/
)
How to obtain the latest Windows XP service packWindows 2000To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:260910
(http://support.microsoft.com/kb/260910/EN-US/
)
How to Obtain the Latest Windows 2000 Service Pack
Security Patch InformationFor more information about how to resolve this vulnerability, click the appropriate link below:Windows XP (All Versions)Download InformationThe following files are available for download from the Microsoft Download Center: Windows XP Professional and Windows XP Home Edition (all languages) Collapse this image 
(http://microsoft.com/downloads/details.aspx?FamilyId=9F81E615-3DEC-4A4B-826A-4E0FEAB42323&displaylang=en)
Collapse this image
(http://microsoft.com/downloads/details.aspx?FamilyId=DBC47904-51C8-475A-9900-3DF363A51A3A&displaylang=en)
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Prerequisites This patch requires the released version of Windows XP or Windows XP Service Pack 1 (SP1). For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 322389 Installation Information
(http://support.microsoft.com/kb/322389/EN-US/
)
How to Obtain the Latest Windows XP Service Pack
This patch supports the following Setup switches:
Windows XP: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1\Q811493 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\Q811493 To install the patch without any user intervention, use the following command line: q811493_wxp_sp2_x86_enu /u /q To install the patch without forcing the computer to restart, use
the following command line: q811493_wxp_sp2_x86_enu /z Note These switches can be combined into one command line.Restart Requirement You must restart your computer after you apply this patch because this patch replaces core system binaries that are loaded during system startup. Removal Information To remove this update, use the Add/Remove Programs tool in Control Panel. System administrators can use the Spunist.exe utility to remove this patch. Spuninst.exe is in the %Windir%\$NTUninstallQ811493$\Spuninst folder, and it supports the following Setup switches:
This patch does not replace any other patches. File Information The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. May 28, 2003 release of the Windows XP patch (contents of Setup package): Date Time Version Size File name -------------------------------------------------------------------- 12-Dec-2002 21:08 5.1.2600.108 1,848,320 Ntkrnlmp.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 1,902,080 Ntkrnlpa.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 1,874,944 Ntkrpamp.exe pre-SP1 12-Dec-2002 21:08 5.1.2600.108 1,879,936 Ntoskrnl.exe pre-SP1 24-Apr-2003 12:57 5.1.2600.1151 1,892,864 Ntkrnlmp.exe with SP1 24-Apr-2003 12:57 5.1.2600.1151 1,949,440 Ntkrnlpa.exe with SP1 24-Apr-2003 12:57 5.1.2600.1151 1,921,536 Ntkrpamp.exe with SP1 24-Apr-2003 12:57 5.1.2600.1151 1,925,760 Ntoskrnl.exe with SP1 Date Time Version Size Path and File name SP Level Processor ------------------------------------------------------------------------------------------------------ 12-Dec-2002 21:08 5.1.2600.108 1,848,320 %Windir%\System32\Ntoskrnl.exe pre-SP1 multiprocessor 12-Dec-2002 21:09 5.1.2600.108 1,874,944 %Windir%\System32\Ntkrnlpa.exe pre-SP1 multiprocessor 12-Dec-2002 21:08 5.1.2600.108 1,879,936 %Windir%\System32\Ntoskrnl.exe pre-SP1 uniprocessor 12-Dec-2002 21:09 5.1.2600.108 1,902,080 %Windir%\System32\Ntkrnlpa.exe pre-SP1 uniprocessor 24-Apr-2003 12:57 5.1.2600.1151 1,892,864 %Windir%\System32\Ntoskrnl.exe with SP1 multiprocessor 24-Apr-2003 12:57 5.1.2600.1151 1,921,536 %Windir%\System32\Ntkrnlpa.exe with SP1 multiprocessor 24-Apr-2003 12:57 5.1.2600.1151 1,925,760 %Windir%\System32\Ntoskrnl.exe with SP1 uniprocessor 24-Apr-2003 12:57 5.1.2600.1151 1,949,440 %Windir%\System32\Ntkrnlpa.exe with SP1 uniprocessor Date Time Version Size File name SP Level -------------------------------------------------------------------- 12-Dec-2002 21:09 5.1.2600.108 5,734,400 Ntkrnlmp.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 5,677,568 Ntoskrnl.exe pre-SP1 24-Apr-2003 12:57 5.1.2600.1151 5,793,536 Ntkrnlmp.exe with SP1 24-Apr-2003 12:57 5.1.2600.1151 5,736,832 Ntoskrnl.exe with SP1 Date Time Version Size Path and File name SP Level Processor ------------------------------------------------------------------------------------------------------ 12-Dec-2002 21:09 5.1.2600.108 5,734,400 %Windir%\System32\Ntoskrnl.exe pre-SP1 multiprocessor 12-Dec-2002 21:09 5.1.2600.108 5,677,568 %Windir%\System32\Ntoskrnl.exe pre-SP1 uniprocessor 24-Apr-2003 12:57 5.1.2600.1151 5,793,536 %Windir%\System32\Ntoskrnl.exe with SP1 multiprocessor 24-Apr-2002 12:57 5.1.2600.1151 5,736,832 %Windir%\System32\Ntoskrnl.exe with SP1 uniprocessor Date Time Version Size File name SP Level -------------------------------------------------------------------- 12-Dec-2002 21:08 5.1.2600.108 1,848,320 Ntkrnlmp.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 1,902,080 Ntkrnlpa.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 1,874,944 Ntkrpamp.exe pre-SP1 12-Dec-2002 21:08 5.1.2600.108 1,879,936 Ntoskrnl.exe pre-SP1 12-Dec-2002 20:38 5.1.2600.1150 1,892,352 Ntkrnlmp.exe with SP1 12-Dec-2002 20:38 5.1.2600.1150 1,948,288 Ntkrnlpa.exe with SP1 12-Dec-2002 20:38 5.1.2600.1150 1,921,024 Ntkrpamp.exe with SP1 12-Dec-2002 20:38 5.1.2600.1150 1,924,480 Ntoskrnl.exe with SP1 Date Time Version Size Path and File name SP Level Processor ------------------------------------------------------------------------------------------------------ 12-Dec-2002 21:08 5.1.2600.108 1,848,320 %Windir%\System32\Ntoskrnl.exe pre-SP1 multiprocessor 12-Dec-2002 21:09 5.1.2600.108 1,874,944 %Windir%\System32\Ntkrnlpa.exe pre-SP1 multiprocessor 12-Dec-2002 21:08 5.1.2600.108 1,879,936 %Windir%\System32\Ntoskrnl.exe pre-SP1 uniprocessor 12-Dec-2002 21:09 5.1.2600.108 1,902,080 %Windir%\System32\Ntkrnlpa.exe pre-SP1 uniprocessor 12-Dec-2002 20:38 5.1.2600.1150 1,892,352 %Windir%\System32\Ntoskrnl.exe with SP1 multiprocessor 12-Dec-2002 20:38 5.1.2600.1150 1,921,024 %Windir%\System32\Ntkrnlpa.exe with SP1 multiprocessor 12-Dec-2002 20:38 5.1.2600.1150 1,924,480 %Windir%\System32\Ntoskrnl.exe with SP1 uniprocessor 12-Dec-2002 20:38 5.1.2600.1150 1,948,288 %Windir%\System32\Ntkrnlpa.exe with SP1 uniprocessor Date Time Version Size File name SP Level -------------------------------------------------------------------- 12-Dec-2002 21:09 5.1.2600.108 5,734,400 Ntkrnlmp.exe pre-SP1 12-Dec-2002 21:09 5.1.2600.108 5,677,568 Ntoskrnl.exe pre-SP1 12-Dec-2002 20:38 5.1.2600.1150 5,791,744 Ntkrnlmp.exe with SP1 12-Dec-2002 20:38 5.1.2600.1150 5,734,912 Ntoskrnl.exe with SP1 Date Time Version Size Path and File name SP Level Processor ------------------------------------------------------------------------------------------------------ 12-Dec-2002 21:09 5.1.2600.108 5,734,400 %Windir%\System32\Ntoskrnl.exe pre-SP1 multiprocessor 12-Dec-2002 21:09 5.1.2600.108 5,677,568 %Windir%\System32\Ntoskrnl.exe pre-SP1 uniprocessor 12-Dec-2002 20:38 5.1.2600.1150 5,791,744 %Windir%\System32\Ntoskrnl.exe with SP1 multiprocessor 12-Dec-2002 20:38 5.1.2600.1150 5,734,912 %Windir%\System32\Ntoskrnl.exe with SP1 uniprocessor Windows XP: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1\Q811493\Filelist HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\Q811493\Filelist Windows 2000Download InformationThe following files are available for download from the Microsoft Download Center: All languages except Japanese NEC Collapse this image
(http://microsoft.com/downloads/details.aspx?FamilyId=CACAC8C0-81E9-413E-B565-5D7B3257A733&displaylang=en)
Collapse this image
(http://www.microsoft.com/downloads/details.aspx?FamilyId=81E6E80C-5E56-4466-98C1-4DDF6CF3893F&displaylang=ja)
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Prerequisites This patch requires Windows 2000 Service Pack 2 (SP2) or Windows 2000 Service Pack 3 (SP3). For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 260910 Installation Information
(http://support.microsoft.com/kb/260910/EN-US/
)
How to Obtain the Latest Windows 2000 Service Pack
This patch supports the following Setup switches:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP4\Q811493 To install the patch without any user intervention, use the following command line: q811493_w2k_sp4_x86_en /u /q To install the patch without forcing the computer to restart, use
the following command line: q811493_w2k_sp4_x86_en /z Note These switches can be combined into one command line.Restart Requirement You must restart your computer after you apply this patch because this patch replaces core system binaries that are loaded during system startup. Removal Information To remove this update, use the Add/Remove Programs tool in Control Panel. System administrators can use the Spunist.exe utility to remove this patch. Spuninst.exe is in the %Windir%\$NTUninstallQ811493$\Spuninst folder, and it supports the following Setup switches:
This patch replaces the patch discussed in the following Microsoft Knowledge Base article: 815021 File Information
(http://support.microsoft.com/kb/815021/
)
MS03-007: Unchecked Buffer in Windows Component May Cause Web Server
The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. NOTE: Unless specifically noted, files will be targeted to systems independent of service pack level, encryption level, or number of processors. Windows 2000 (contents of Setup package): Date Time Version Size File name Processor ------------------------------------------------------------------------- 15-Aug-2002 11:34 5.0.2195.5265 42,256 Basesrv.dll 17-Jan-2003 12:06 5.0.2195.6656 236,304 Cmd.exe 15-Aug-2002 11:34 5.0.2195.5907 222,992 Gdi32.dll 15-Aug-2002 11:34 5.0.2195.6011 708,880 Kernel32.dll uniprocessor 04-Feb-2003 16:15 5.0.2195.6661 29,264 Mountmgr.sys 15-Aug-2002 11:34 5.0.2195.4733 332,560 Msgina.dll 27-Mar-2003 16:13 5.0.2195.6685 476,944 Ntdll.dll uniprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,689,216 Ntkrnlmp.exe multiprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,688,832 Ntkrnlpa.exe uniprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,709,440 Ntkrpamp.exe multiprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,666,944 Ntoskrnl.exe uniprocessor 21-Mar-2003 17:43 5.0.2195.6692 90,232 Rdpwd.sys 128-bit 15-Aug-2002 11:34 5.0.2195.6000 379,664 User32.dll 15-Aug-2002 11:34 5.0.2195.5968 369,936 Userenv.dll 08-Aug-2002 18:23 5.0.2195.6003 1,642,416 Win32k.sys uniprocessor 15-Aug-2002 11:30 5.0.2195.6013 179,472 Winlogon.exe 15-Aug-2002 11:34 5.0.2195.5935 243,472 Winsrv.dll uniprocessor 27-Mar-2003 16:14 5.0.2195.6692 90,200 Rdpwd.sys 56-bit 15-Aug-2002 11:34 5.0.2195.6011 708,880 Kernel32.dll multiprocessor 02-Apr-2003 15:56 5.0.2195.6685 476,944 Ntdll.dll multiprocessor 15-Aug-2002 11:34 5.0.2195.6003 1,642,416 Win32k.sys multiprocessor 15-Aug-2002 11:34 5.0.2195.5935 243,472 Winsrv.dll multiprocessor Date Time Version Size Path and File name Processor/Encryption Level --------------------------------------------------------------------------------------------------------------- 15-Aug-2002 11:34 5.0.2195.5265 42,256 %Windir%\System32\Basesrv.dll 17-Jan-2003 12:06 5.0.2195.6656 236,304 %Windir%\System32\Cmd.exe 15-Aug-2002 11:34 5.0.2195.5907 222,992 %Windir%\System32\Gdi32.dll 04-Feb-2003 16:15 5.0.2195.6661 29,264 %Windir%\System32\Drivers\Mountmgr.sys 15-Aug-2002 11:34 5.0.2195.4733 332,560 %Windir%\System32\Msgina.dll 21-Mar-2003 17:43 5.0.2195.6692 90,232 %Windir%\System32\Drivers\Rdpwd.sys 128-bit 15-Aug-2002 11:34 5.0.2195.6000 379,664 %Windir%\System32\User32.dll 15-Aug-2002 11:34 5.0.2195.5968 369,936 %Windir%\System32\Userenv.dll 15-Aug-2002 11:30 5.0.2195.6013 179,472 %Windir%\System32\Winlogon.exe 27-Mar-2003 16:14 5.0.2195.6692 90,200 %Windir%\System32\drivers\Rdpwd.sys 56-bit 15-Aug-2002 11:34 5.0.2195.6011 708,880 %Windir%\System32\Kernel32.dll multiprocessor 27-Mar-2003 16:13 5.0.2195.6685 476,944 %Windir%\System32\Ntdll.dll multiprocessor 08-Aug-2002 18:23 5.0.2195.6003 1,642,416 %Windir%\System32\Win32k.sys multiprocessor 15-Aug-2002 11:34 5.0.2195.5935 243,472 %Windir%\System32\Winsrv.dll multiprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,709,440 %Windir%\System32\Ntkrnlpa.exe multiprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,689,216 %Windir%\System32\Ntoskrnl.exe multiprocessor 15-Aug-2002 11:34 5.0.2195.6011 708,880 %Windir%\System32\Kernel32.dll uniprocessor 02-Apr-2003 15:56 5.0.2195.6685 476,944 %Windir%\System32\Ntdll.dll uniprocessor 15-Aug-2002 11:34 5.0.2195.6003 1,642,416 %Windir%\System32\Win32k.sys uniprocessor 15-Aug-2002 11:34 5.0.2195.5935 243,472 %Windir%\System32\Winsrv.dll uniprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,688,832 %Windir%\System32\Ntkrnlpa.exe uniprocessor 12-Dec-2002 18:22 5.0.2195.6159 1,666,944 %Windir%\System32\Ntoskrnl.exe uniprocessor HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP4\Q811493\Filelist Windows NT 4.0 (all versions)Download InformationThe following files are available for download from the Microsoft Download Center: Windows NT 4.0 Server and Windows NT 4.0 Workstation (all languages except Japanese NEC and Chinese - Hong Kong) Collapse this image
(http://microsoft.com/downloads/details.aspx?FamilyId=C3596ED1-596F-416C-8BE5-91AE65619A1A&displaylang=en)
Collapse this image
(http://www.microsoft.com/downloads/details.aspx?FamilyId=6D83F8BA-BF16-4EC5-9187-9B03E9AE825F&displaylang=ja)
Collapse this image
(http://www.microsoft.com/downloads/details.aspx?FamilyId=0FF5C348-F7A0-44E8-8D82-557389FB4590&displaylang=zh-tw)
Collapse this image
(http://www.microsoft.com/downloads/details.aspx?amp;displaylang=en&familyid=910A0015-3723-4A4E-9049-99A4CE52B5F8&displaylang=en)
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Prerequisites This patch requires Windows NT 4.0 Service Pack 6a (SP6a) or Windows NT Server 4.0, Terminal Server Edition Service Pack 6 (SP6). For additional information, click the article number below to view the article in the Microsoft Knowledge Base: 152734 Installation Information
(http://support.microsoft.com/kb/152734/EN-US/
)
How to Obtain the Latest Windows NT 4.0 Service Pack
This patch supports the following Setup switches:
To install the patch without any user intervention, use the following command line: q811493i /q To install the patch without forcing the computer to restart, use
the following command line: q811493i /z Note These switches can be combined into one command line.Restart Requirement You must restart your computer after you apply this patch because this patch replaces core system binaries that are loaded during system startup. Removal Information To remove this update, use the Add/Remove Programs tool in Control Panel. System administrators can use the Spunist.exe utility to remove this patch. Spuninst.exe is in the %Windir%\$NTUninstallQ811493$\Spuninst folder, and it supports the following Setup switches:
This patch does not replace any other patches. File Information The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. NOTE: Unless specifically noted, files will be targeted to systems independent of service pack level, encryption level, or number of processors. Windows NT 4.0 (contents of Setup package): Date Time Version Size File name -------------------------------------------------------- 12-Dec-2002 18:16 4.0.1381.7203 957,504 Ntkrnlmp.exe 12-Dec-2002 18:16 4.0.1381.7203 937,280 Ntoskrnl.exe Date Time Version Size Path and File name Processor ------------------------------------------------------------------------------------------ 12-Dec-2002 18:16 4.0.1381.7203 957,504 %Windir%\System32\Ntoskrnl.exe multiprocessor 12-Dec-2002 18:16 4.0.1381.7203 937,280 %Windir%\System32\Ntoskrnl.exe uniprocessor Date Time Version Size File name ----------------------------------------------------------- 12-Dec-2002 18:29 4.0.1381.33545 1,004,160 Ntkrnlmp.exe 12-Dec-2002 18:29 4.0.1381.33545 983,168 Ntoskrnl.exe Date Time Version Size Path and File name Processor --------------------------------------------------------------------------------------------- 12-Dec-2002 18:29 4.0.1381.33545 1,004,160 %Windir%\System32\Ntoskrnl.exe multiprocessor 12-Dec-2002 18:29 4.0.1381.33545 983,168 %Windir%\System32\Ntoskrnl.exe uniprocessor STATUS Microsoft has confirmed that this problem
may cause a degree of security vulnerability in the Microsoft products that are
listed at the beginning of this article.
Windows 2000 OnlyThis problem was first corrected in Microsoft Windows 2000 Service Pack 4.Windows XP OnlyThis problem was first corrected in Microsoft Windows XP Service Pack 2.MORE INFORMATION For more information about this vulnerability, visit the
following Microsoft Web site: http://www.microsoft.com/technet/security/bulletin/MS03-013.mspx
(http://www.microsoft.com/technet/security/bulletin/MS03-013.mspx)
PropertiesArticle ID: 811493 - Last Review: May 17, 2007 - Revision: 15.7 APPLIES TO
| Article Translations
 |
Back to the top
