MS-RPC: MQSVC Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Microsoft Windows MQSVC service. Because of improper bounds checking in the service, an attacker can trigger a buffer overflow in the affected system. This action can lead to arbitrary code execution at System level privileges.

Extended Description

A remote buffer overflow vulnerability affects Microsoft Windows. This issue is due to a failure of the affected functionality to properly validate the length of user-supplied strings prior to copying them into static process buffers. This vulnerability may be exploited over RPC. An attacker may exploit this issue to execute arbitrary code with SYSTEM privileges, facilitating unauthorized access or privilege escalation. It should be noted that MSMQ is not installed by default on affected platforms and must be manually installed for a computer to be vulnerable. The vulnerability is reportedly not present on computers that only enable MSMQ HTTP Message Delivery.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 13112

CVE: CVE-2005-0059

URL: http://oval.mitre.org/oval/definitions/data/oval4988.html http://oval.mitre.org/oval/definitions/data/oval4384.html

Short Name

MS-RPC:OF:MQSVC

Severity

Critical

Recommended

False

Recommended Action

Drop

MS-RPC: MQSVC Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?