Microsoft Windows RPC mutual authentication spoofing
| win-rpc-mutual-authentication-spoofing (26836) |  Medium Risk |
Description:
The RPC client in Microsoft Windows could allow a remote attacker to spoof a legitimate RPC service, caused by a vulnerability regarding the user of mutual authentication over Secure Socket Layer (SSL). A remote attacker could exploit this vulnerability to persuade a victim into connecting to a malicious RPC service that appears to be legitimate.
Platforms Affected:
- Microsoft, Windows 2000 SP4
Remedy:
Apply the appropriate patch for your system, as listed in the latest Microsoft Security Bulletin. See References.
— OR —
Use Microsoft Automatic Update if it is supported by your operating system. The original bulletin issued by Microsoft has been superseded.
Consequences:
Other
References:
- Microsoft Security Bulletin MS06-031, Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736) at http://www.microsoft.com/technet/security/Bulletin/MS06-031.mspx.
- Microsoft Security Bulletin MS07-058, Vulnerability in RPC Could Allow Denial of Service (933729) at http://www.microsoft.com/technet/security/Bulletin/ms07-058.mspx.
- ASA-2006-126: Windows Security Updates for June 2006 - (MS06-021 - MS06-032)
- BID-18389: Microsoft Windows RPC Mutual Authentication Service Spoofing Vulnerability
- CVE-2006-2380: Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the RPC Mutual Authentication Vulnerability.
- OSVDB ID: 26438: Microsoft Windows RPC Mutual Authentication Server Spoofing
- SA20637: Microsoft Windows RPC Mutual Authentication Vulnerability
- SECTRACK ID: 1016289: Microsoft RPC Mutual Authentication Bug Lets Remote Users Spoof Other Systems
- VUPEN/ADV-2006-2328: Microsoft Windows RPC Mutual Authentication Spoofing Vulnerability (MS06-031)
Reported:
Jun 13, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net