MS-RPC: MS Message Queue Buffer Overflow

This signature detects attempts to exploit a known remote code execution vulnerability against Message Queuing. A successful exploit can allow an attacker to take complete control of the affected system.

Extended Description

A remote buffer overflow vulnerability affects Microsoft Windows. This issue is due to a failure of the affected functionality to properly validate the length of user-supplied strings prior to copying them into static process buffers. This vulnerability may be exploited over RPC. An attacker may exploit this issue to execute arbitrary code with SYSTEM privileges, facilitating unauthorized access or privilege escalation. It should be noted that MSMQ is not installed by default on affected platforms and must be manually installed for a computer to be vulnerable. The vulnerability is reportedly not present on computers that only enable MSMQ HTTP Message Delivery.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 26797 13112

CVE: CVE-2007-3039

URL: http://www.kb.cert.org/vuls/id/763513 http://www.zerodayinitiative.com/advisories/zdi-07-076.html

Short Name

MS-RPC:MSGQU-FRNAME

Severity

Critical

Recommended

False

Recommended Action

Drop

MS-RPC: MS Message Queue Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?