SPOOLSS.EXE memory leak denial of service
| nt-spoolss (523) |  Medium Risk |
Description:
SPOOLSS.EXE is vulnerable to a denial of service attack. An attacker can open multiple named pipe connections and send random data. When Windows NT 4.0 attempts to close the invalid connections, the RPC service consumes all system resources, and may hang the system. There is no risk of compromising or losing data because of this attack.
Consequences:
Denial of Service
Remedy:
Apply the latest Windows NT 4.0 Service Pack 5 (SP5), as listed in Microsoft Knowledge Base Article Q195733.
— AND —
For Windows NT Server 4.0:
Apply the postSP4 nprpcfxi hotfix patch, as listed in Microsoft Security Bulletin MS98-017. See References.
For Windows NT Server 4.0, Terminal Server Edition:
Apply the postSP4 nprpcfxa hotifix patch, as listed in Microsoft Security Bulletin MS98-017. See References.
References:
- Fyodor's Exploit World: SPOOLSS.EXE memory leak.
- Microsoft Knowledge Base Article 195733: Denial of Service in Applications Using Named Pipes Over RPC.
- Microsoft Security Bulletin MS98-017: Patch Available for "Named Pipes Over RPC" Issue.
- NTBugTraq Mailing List, Thu, 21 Aug 1997 11:50:51 +0200: SPOOLSS.EXE memory leak.
- CVE-1999-1127: Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the Named Pipes Over RPC vulnerability.
Platforms Affected:
- Microsoft Windows NT 3.5.1 SP4
- Microsoft Windows NT 4.0 Terminal Server
Reported:
Aug 21, 1997
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net