MS-RPC: DCE-RPC Null Pointer Dereference

This signature detects attempts to exploit a known flaw in Microsoft Windows 2000 DCE-RPC service. A successful attack can result in a denial-of-service condition.

Extended Description

The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the RPC service will be disabled. This vulnerability was originally reported to only affect Windows 2000. Microsoft has confirmed that Windows NT 4.0 and XP are also vulnerable. It has been reported that installation of the provided patch will cause some problems in IIS environments. Specifically, users who are using COM+ in IIS environments may experience problems with ASP transactions. A variant of this issue has been reported which allegedly affects patched systems. It is apparently possible to trigger this variant by flooding a system with malformed packets.

Affected Products

Microsoft windows_nt_terminal_server

References

BugTraq: 6005

CVE: CVE-2002-1561

URL: http://www.securityfocus.com/archive/1/296114/2002-10-14/2002-10-20/0

Short Name

MS-RPC:DCERPC-DOS

Severity

Major

Recommended

False

Recommended Action

Drop

MS-RPC: DCE-RPC Null Pointer Dereference

Extended Description

Affected Products

References

Found a potential security threat?