10.15.2003 - MS03-041: Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)

There is a vulnerability in Authenticode that, under certain low memory conditions, could allow an ActiveX control to download and install without presenting the user with an approval dialog. To exploit this vulnerability, an attacker could host a malicious Web Site designed to exploit this vulnerability. If an attacker then persuaded a user to visit that site an ActiveX control could be installed and executed on the user’s system. Alternatively, an attacker could create a specially formed HTML e-mail and send it to the user. If the user viewed the HTML e-mail an unauthorized ActiveX control could be installed and executed on the user’s system. In both scenarios the vulnerability in Authenticode could allow an unauthorized ActiveX control to be installed and executed on the user’s system, with the same permissions as the user, without prompting the user for approval. - Download Windows NT Workstation 4.0 SP6a Patch - Download Windows NT Server 4.0 SP6a Patch - Download Windows NT Server 4.0,Terminal Server Edition SP6 Patch - Download Windows 2000 SP2 Patch - Download Windows 2000 SP3 & SP4 Patch - Download Windows XP SP1 Patch - Download Windows XP 64-Bit Edition Patch - Download Windows XP 64-Bit Edition Version 2003 Patch - Download Windows Server 2003 Patch - Download Windows Server 2003 64 bit Edition Patch - View Microsoft Knowledge Base Article - 823182 - View Microsoft Security Bulletin - View Microsoft End User Security Bulletin - Visit Microsoft Corporation