MS-RPC: Microsoft Distributed Transaction Coordinator Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Distributed Transaction Coordinator (msdtc.exe) process. A successful exploit can result in remote code execution with System privileges. You should use this signature to examine Internet-facing connections.

Extended Description

The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.

Affected Products

Microsoft windows_2000

References

BugTraq: 15056

CVE: CVE-2005-2119

URL: http://www.microsoft.com/technet/security/bulletin/MS05-051.mspx http://www.kb.cert.org/vuls/id/180868 http://www.us-cert.gov/cas/techalerts/TA05-284A.html

Short Name

MS-RPC:OF:MSDTC

Severity

Critical

Recommended

False

Recommended Action

Drop

MS-RPC: Microsoft Distributed Transaction Coordinator Overflow

Extended Description

Affected Products

References

Found a potential security threat?