Microsoft Windows MS03-039 patch is not installed
| win-ms03039-patch (13134) |  High Risk |
Description:
Microsoft Windows is vulnerable to two buffer overflows, caused by improper handling of Remote Procedure Call (RPC) messages for Distributed Component Object Model (DCOM) activation by the RPCSS service, which is addressed in Microsoft Security Bulletin MS03-019. By default, the RPCSS service is enabled. A remote attacker could establish a connection and send a malformed RPC message to overflow a buffer and execute arbitrary code on the system with Local System privileges or cause the RPC service to hang.
Platforms Affected:
- Microsoft, Windows 2000
- Microsoft, Windows 2003 Server
- Microsoft, Windows NT 4.0 Terminal Server
- Microsoft, Windows NT 4.0 Server
- Microsoft, Windows NT 4.0 Workstation
- Microsoft, Windows XP
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS03-039. See References.
Consequences:
Gain Access
References:
- IBM Internet Security Systems X-Force Database, Microsoft Windows RPC DCOM denial of service at http://xforce.iss.net/xforce/xfdb/12679.
- IBM Internet Security Systems X-Force Database, Microsoft Windows RPCSS DCOM buffer overflows at http://xforce.iss.net/xforce/xfdb/13129.
- Microsoft Security Bulletin MS03-039, Buffer Overrun In RPCSS Service Could Allow Code Execution (824146) at http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx.
- CVE-2003-0528: Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.
- CVE-2003-0605: The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
- CVE-2003-0715: Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net