MS-RPC: Microsoft Server Service Overflow (1)

This signature detects attempts to exploit a known vulnerability in Microsoft Windows Server service (srvsvc). A remote attacker can send a maliciously crafted RPC requests to the problematic service; thus leading to a denial-of-service condition.

Extended Description

Microsoft Windows Plug and Play service is prone to a denial of service condition. This issue is caused by a malformed request to the service that causes virtual memory consumption. On Windows XP, a remote attacker must authenticate over RPC to exploit this issue using the originally described attack vector. Update: A reliable source has indicated that this issue is anonymously exploitable via named pipes or other MSRPC calls on Microsoft Windows XP SP2. This issue may be exploited by differing attack vectors than originally described by Microsoft.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 25232 15460 23973 24195 24198

CVE: CVE-2007-2446

URL: http://us1.samba.org/samba/security/cve-2007-2446.html http://www.zerodayinitiative.com/advisories/zdi-07-033.html

Short Name

MS-RPC:OF:SRV-SVC-1

Severity

Major

Recommended

False

Recommended Action

None

MS-RPC: Microsoft Server Service Overflow (1)

Extended Description

Affected Products

References

Found a potential security threat?