Rule: --Sid: 3101-- Summary: This event is generated when an attempt is made to exploit a knownvulnerability in Microsoft License Logging Service.-- Impact: Serious. Execution of arbitrary code leading to unauthorizedadministrative access to the target host. Denial of Service (DoS) isalso possible.--Detailed Information:Microsoft License Logging Service is used to manage licenses forMicrosoft server products.A vulnerability in the service exists due to a programming error suchthat an unchecked buffer may present an attacker with the opportunity toexploit the service and run code of their choosing on an affectedsystem. The attacker may then cause a DoS condition in the service orpossibly gain administrative access to the target host.The unchecked buffer exists when processing the length of messages sentto the logging service.--Affected Systems:	Microsoft Windows Server 2003	Microsoft Windows Server 2000	Microsoft Windows NT Server--Attack Scenarios: An attacker can supply extra data in the message to the servicecontaining code of their choosing to be run on the server.-- Ease of Attack: Simple.-- False Positives:None known.--False Negatives:None known.-- Corrective Action: Apply the appropriate vendor supplied patches.--Contributors: Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--