quote:

---

Title: Unchecked Buffer in MDAC Function Could Enable System
Compromise (823718)
Date: 20 August 2003
Software:
- Microsoft Data Access Components 2.5
- Microsoft Data Access Components 2.6
- Microsoft Data Access Components 2.7

Impact: Run code of the attacker's choice
Max Risk: Important
Bulletin: MS03-033

Microsoft encourages customers to review the Security Bulletins
at:
http://www.microsoft.com/technet/security/bulletin/MS03-033.asp
http://www.microsoft.com/security/security_bulletins/ms03-033.asp

...

An attacker who successfully exploited this flaw could gain the
same level of privileges over the system as the application that
initiated the broadcast request. The actions an attacker could
carry out would be dependent on the permissions which the
application using MDAC ran under. If the application ran with
limited privileges, an attacker would be limited accordingly;
however, if the application runs under the local system context,
the attacker would have the same level of permissions. This could
include creating, modifying, or deleting data on the system, or
reconfiguring the system. This could also include reformatting
the hard disk or running programs of the attacker's choice.

---