MS-RPC: DCOM Exploit

This signature detects attempts to exploit a known vulnerability in Microsoft Windows Remote Procedure Call (RPC) system. Windows 2000 and XP are vulnerable. RPC is an operating system component that enables remote computers to request actions or services. For example, file and print sharing from the local Windows system. Attackers can use dcom.c to send too much data to the RPC process, causing the local system to grant full access to the remote computer. Also, the W32.Blaster and Nachi/Welchia worms can be detected or blocked using this signature.

Extended Description

Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.

Affected Products

Microsoft windows_2000

References

BugTraq: 8205

CVE: CVE-2003-0352

URL: http://www.kb.cert.org/vuls/id/568148 http://www.microsoft.com/technet/security/bulletin/MS03-026.asp http://technet.microsoft.com/security/bulletin/ms03-026 https://technet.microsoft.com/en-us/library/security/ms03-026

Short Name

MS-RPC:DCOM:EXPLOIT

Severity

Critical

Recommended

False

Recommended Action

Drop

MS-RPC: DCOM Exploit

Extended Description

Affected Products

References

Found a potential security threat?