Signature Detail

HTTP: Windows Groupfile Download via HTTP

This signature detects GRP files sent over HTTP. GRP files can contain Windows Program Group information and can be exploited by malcious users to deposit instructions or arbritrary code on a target's system. User involvement is required to activate GRP files; typically they are attached or linked to a harmless-appearing e-mail message.

Extended Description

Microsoft Windows operating systems have been reported to be prone to a remotely exploitable buffer overrun condition. This issue is exposed when a client attempts to connect to an SMB share with an overly long name. This may cause explorer.exe or Internet Explorer to crash but could also potentially be leveraged to execute arbitrary code as the client user.

Affected Products

• Avaya definityone_media_servers R10
• Avaya definityone_media_servers R11
• Avaya definityone_media_servers R12
• Avaya definityone_media_servers R6
• Avaya definityone_media_servers R7
• Avaya definityone_media_servers R8
• Avaya definityone_media_servers R9
• Avaya definityone_media_servers
• Avaya ip600_media_servers R10
• Avaya ip600_media_servers R11
• Avaya ip600_media_servers R12
• Avaya ip600_media_servers R6
• Avaya ip600_media_servers R7
• Avaya ip600_media_servers R8
• Avaya ip600_media_servers R9
• Avaya ip600_media_servers
• Avaya modular_messaging_(mss) 1.1.0
• Avaya modular_messaging_(mss) 2.0.0
• Avaya s3400_message_application_server
• Avaya s8100_media_servers R10
• Avaya s8100_media_servers R11
• Avaya s8100_media_servers R12
• Avaya s8100_media_servers R6
• Avaya s8100_media_servers R7
• Avaya s8100_media_servers R8
• Avaya s8100_media_servers R9
• Avaya s8100_media_servers
• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_2000_server
• Microsoft windows_98
• Microsoft windows_98se
• Microsoft windows_me
• Microsoft windows_nt_enterprise_server 4.0
• Microsoft windows_nt_enterprise_server 4.0 SP1
• Microsoft windows_nt_enterprise_server 4.0 SP2
• Microsoft windows_nt_enterprise_server 4.0 SP3
• Microsoft windows_nt_enterprise_server 4.0 SP4
• Microsoft windows_nt_enterprise_server 4.0 SP5
• Microsoft windows_nt_enterprise_server 4.0 SP6
• Microsoft windows_nt_enterprise_server 4.0 SP6a
• Microsoft windows_nt_server 4.0
• Microsoft windows_nt_server 4.0 SP1
• Microsoft windows_nt_server 4.0 SP2
• Microsoft windows_nt_server 4.0 SP3
• Microsoft windows_nt_server 4.0 SP4
• Microsoft windows_nt_server 4.0 SP5
• Microsoft windows_nt_server 4.0 SP6
• Microsoft windows_nt_server 4.0 SP6a
• Microsoft windows_nt_terminal_server 4.0
• Microsoft windows_nt_terminal_server 4.0 SP1
• Microsoft windows_nt_terminal_server 4.0 SP2
• Microsoft windows_nt_terminal_server 4.0 SP3
• Microsoft windows_nt_terminal_server 4.0 SP4
• Microsoft windows_nt_terminal_server 4.0 SP5
• Microsoft windows_nt_terminal_server 4.0 SP6
• Microsoft windows_nt_workstation 4.0
• Microsoft windows_nt_workstation 4.0 SP1
• Microsoft windows_nt_workstation 4.0 SP2
• Microsoft windows_nt_workstation 4.0 SP3
• Microsoft windows_nt_workstation 4.0 SP4
• Microsoft windows_nt_workstation 4.0 SP5
• Microsoft windows_nt_workstation 4.0 SP6
• Microsoft windows_nt_workstation 4.0 SP6a
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_datacenter_edition_itanium
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_enterprise_edition_itanium
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_web_edition
• Microsoft windows_xp_64-bit_edition SP1
• Microsoft windows_xp_64-bit_edition
• Microsoft windows_xp_64-bit_edition_version_2003 SP1
• Microsoft windows_xp_64-bit_edition_version_2003
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition

References

• BugTraq: 10213
• CVE: CVE-2004-0214
• URL: http://www.microsoft.com/technet/security/bulletin/MS04-037.mspx
• URL: http://www.internetfixes.com/file_ext.htm