Windows messages provide a way for interactive processes to react to user events (such as keystrokes or mouse movements) and communicate with other interactive processes. The WM_TIMER message is sent at the expiration of a timer, and it can be used to cause a process to run a timer callback function. This message may create a security vulnerability because it is possible for one process in the interactive desktop to use a WM_TIMER message to cause another process to run a callback function at the address of its choice, even if the second process did not set a timer. If that second process has higher privileges than the first process, this would provide the first process with a way of exercising the functions.

By default, several of the processes that are running in the interactive desktop do so with LocalSystem privileges. As a result, an attacker who can log on to a system interactively can potentially run a program that would levy a WM_TIMER request upon such a process, causing it to take any action the attacker specified. In this scenario, the attacker can have complete control over the system.

The security patch that is described in this article addresses this vulnerability, and it also makes changes to several processes that run on the interactive desktop with high privileges. Although none of these processes would allow an attacker to gain privileges on the system in the absence of the WM_TIMER vulnerability, we have included them in the patch to make the services more robust.

Back to the top

Service pack information

Windows XP

To resolve this problem, obtain the latest service pack for Microsoft Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

Windows 2000

To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Hotfix information

For more information about how to resolve this vulnerability, click any of the following links:

•	Windows XP (all versions)
•	Windows 2000 (all versions)
•	Windows NT (all versions)

Back to the top

Windows XP (All Versions)

Download Information

The following files are available for download from the Microsoft Download Center:

Windows XP Home Edition and ProfessionalWindows XP 64-bit Edition Release Date: December 11, 2002

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

This update can be applied to the RTM version of Windows XP or to Windows XP Service Pack 1 (SP1). You must restart your computer after you apply this update. This update supports the following Setup switches:

•	/? : Display the list of installation switches.
•	/u : Use unattended mode.
•	/f : Force other programs to quit when the computer shuts down.
•	/n : Do not back up files for removal.
•	/o : Overwrite OEM files without prompting.
•	/z : Do not restart when installation is complete.
•	/q : Use Quiet mode (no user interaction).
•	/l : List installed hotfixes.
•	/x Extract the files without running Setup.

For example, to install the update without any user intervention, and then not to force the computer to restart, use the following command line: Warning Your computer is vulnerable until you restart it.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

The following files are copied to the %WINDIR%\System32 folder.

Windows XP Home Edition and Windows XP Professional

   Date          Time    Version         Size        File name 
   -----------------------------------------------------------------------
   08-Oct-2002   20:19                   1,053,822   Sysmain.sdb (pre-SP1)
   22-Nov-2002   17:16   5.1.2600.104      528,896   User32.dll (pre-SP1)
   21-Oct-2002   22:45   5.1.2600.104    1,671,168   Win32k.sys (pre-SP1)
   22-Nov-2002   17:16   5.1.2600.104      272,384   Winsrv.dll (pre-SP1)
   01-Nov-2002   19:13                   1,080,070   Sysmain.sdb (with SP1)
   01-Nov-2002   20:26   5.1.2600.1134     528,896   User32.dll (with SP1)
   23-Oct-2002   13:55   5.1.2600.1134   1,694,336   Win32k.sys (with SP1)
   01-Nov-2002   20:26   5.1.2600.1134     272,896   Winsrv.dll (with SP1)

Windows XP 64-Bit Edition

   Date          Time    Version        Size        File name
   ----------------------------------------------------------------------
   08-Oct-2002   20:19                  1,053,822   Sysmain.sdb (pre-SP1)
   22-Nov-2002   17:16   5.1.2600.104   1,480,704   User32.dll (pre-SP1)
   21-Oct-2002   22:45   5.1.2600.104   5,534,208   Win32k.sys (pre-SP1)
   22-Nov-2002   17:16   5.1.2600.104     823,808   Winsrv.dll (pre-SP1)
   08-Oct-2002   20:19                  1,053,822   Wsysmain.sdb (pre-SP1)
   21-Oct-2002   22:40   5.1.2600.104     555,520   Wuser32.dll (pre-SP1)
   01-Nov-2002   18:52                  1,085,382   Sysmain.sdb
   01-Nov-2002   20:26   5.1.2600.1134  1,481,728   User32.dll (with SP1)
   23-Oct-2002   13:55   5.1.2600.1134  5,621,888   Win32k.sys (with SP1)
   01-Nov-2002   20:26   5.1.2600.1134    824,320   Winsrv.dll (with SP1)
   01-Nov-2002   19:13                  1,080,070   Wsysmain.sdb (with SP1)
   23-Oct-2002   13:57   5.1.2600.1134    556,032   Wuser32.dll (with SP1)

Back to the top

Windows 2000 (All Versions) Hotfix Information

Download Information

The following files are available for download from the Microsoft Download Center:
Release Date: December 11, 2002

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

This update requires Windows 2000 Service Pack 1 (SP1), Windows 2000 Service Pack 2 (SP2), or Windows 2000 Service Pack 3 (SP3). For additional information about how to obtain the latest service pack, click the article number below to view the article in the Microsoft Knowledge Base: You must restart your computer after you apply this update. This update supports the following Setup switches:

•	/? : Display the list of installation switches.
•	/u : Use Unattended mode.
•	/f : Force other programs to quit when the computer shuts down.
•	/n : Do not back up files for removal.
•	/o : Overwrite OEM files without prompting.
•	/z : Do not restart when installation is complete.
•	/q : Use Quiet mode (no user interaction).
•	/l : List installed hotfixes.
•	/x : Extract the files without running Setup.

For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line: Warning Your computer is vulnerable until you restart it.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

The following files are copied to the %WINDIR%\System32 folder:

   Date          Time    Version         Size        File name
   ---------------------------------------------------------------
   01-Nov-2002   21:33   5.0.2195.5265      42,256   Basesrv.dll
   01-Nov-2002   21:33   5.0.2195.5907     222,992   Gdi32.dll
   01-Nov-2002   21:33   5.0.2195.6079     708,880   Kernel32.dll
   01-Nov-2002   21:33   5.0.2195.6090     332,560   Msgina.dll
   01-Nov-2002   21:33   5.0.2195.6097     379,664   User32.dll
   01-Nov-2002   21:33   5.0.2195.6085     370,448   Userenv.dll
   21-Oct-2002   13:26   5.0.2195.6097   1,643,248   Win32k.sys
   29-Oct-2002   15:59   5.0.2195.6108     179,472   Winlogon.exe
   01-Nov-2002   21:33   5.0.2195.6097     243,472   Winsrv.dll

Note Because of file dependencies, this update may contain additional files.

Back to the top

Windows NT 4.0 (All Versions)

Download Information

The following files are available for download from the Microsoft Download Center:

Windows NT 4.0

Windows NT Server 4.0, Terminal Server Edition

Release Date: December 11, 2002

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Installation Information

This update requires Windows NT 4.0 Service Pack 6a (SP6a) or Windows NT Server 4.0, Terminal Server Edition Service Pack 6 (SP6). For additional information, click the following article number to view the article in the Microsoft Knowledge Base: You must restart your computer after you apply this update. This update supports the following Setup switches:

•	/y : Perform removal (only with /m or /q ).
•	/f : Force programs to be closed at shutdown.
•	/n : Do not create an Uninstall folder.
•	/z : Do not restart when update completes.
•	/q : Use Quiet or Unattended mode with no user interface (this switch is a superset of /m ).
•	/m : Use Unattended mode with user interface.
•	/l : List installed hotfixes.
•	/x : Extract the files without running Setup.

For example, to install the update without any user intervention, and then to not force the computer to restart, use the following command line: Warning Your computer is vulnerable until you restart it.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

The following files are copied to the %WINDIR%\System32 folder.

Windows NT 4.0

   Date          Time    Version           Size      File name
   --------------------------------------------------------------
   30-Dec-2002   22:12   4.0.1381.7177     169,744   Gdi32.dll
   30-Dec-2002   22:12   4.0.1381.7202     326,928   User32.dll
   30-Dec-2002   22:12   4.0.1381.7202     175,888   Winsrv.dll
   30-Jan-2003   17:57   4.0.1381.7207   1,255,024   Win32k.sys

Windows NT Server 4.0, Terminal Server Edition

   Date          Time    Version          Size        File name
   --------------------------------------------------------------
   05-Apr-2002   23:38   4.0.1381.33535     170,256   Gdi32.dll
   11-Nov-2002   22:09   4.0.1381.33544     332,048   User32.dll
   11-Nov-2002   22:09   4.0.1381.33544     196,368   Winsrv.dll
   24-Feb-2003   15:10   4.0.1381.33546   1,280,048   Win32k.sys

Note Because of file dependencies, this update may contain additional files.

Back to the top

Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed in the "Applies to" section.

Back to the top

Windows XP

This problem was first corrected in Microsoft Windows XP Service Pack 2.

Back to the top

Windows 2000

This problem was first corrected in Microsoft Windows 2000 Service Pack 4.

Back to the top

For more information about this vulnerability, visit the following Microsoft Web site:

Back to the top