MS-RPC: Message Queue Overflow (3)

This signature detects attempts to exploit a known vulnerability against MS-RPC Message Queue request. By sending overlong free-form string queue requests, which can cause invalid client replies, an attacker can cause a buffer overflow and compromise the affected system.

Extended Description

A remote buffer overflow vulnerability affects Microsoft Windows. This issue is due to a failure of the affected functionality to properly validate the length of user-supplied strings prior to copying them into static process buffers. This vulnerability may be exploited over RPC. An attacker may exploit this issue to execute arbitrary code with SYSTEM privileges, facilitating unauthorized access or privilege escalation. It should be noted that MSMQ is not installed by default on affected platforms and must be manually installed for a computer to be vulnerable. The vulnerability is reportedly not present on computers that only enable MSMQ HTTP Message Delivery.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 13112

CVE: CVE-2005-0059

URL: http://www.sans.org/newsletters/risk/display.php?v=4&i=15#05.15.1

Short Name

MS-RPC:OF:MSG-QUEUE-3

Severity

Major

Recommended

False

Recommended Action

Drop

MS-RPC: Message Queue Overflow (3)

Extended Description

Affected Products

References

Found a potential security threat?