SMB: Microsoft TAPI Service Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft's TAPI Service. A remote code execution vulnerability exists in Telephony Application Programming Interface (TAPI) that can allow an attacker, who successfully exploited this vulnerability, to take complete control of the affected system.

Extended Description

Microsoft Windows Telephony Service is prone to a buffer-overflow vulnerability. This issue is due to a failure in the application to perform proper bounds checking on user-supplied data. A successful attack can result in overflowing a finite-sized buffer, ultimately leading to arbitrary code execution in the context of the affected service. This may allow the attacker to execute arbitrary code remotely or locally to gain elevated privileges. Remote code execution is possible only on Windows 2000 Server and Windows Server 2003; for other vulnerable platforms, the attacker must have local interactive access.

Affected Products

Microsoft windows_2000_server

References

BugTraq: 14518

CVE: CVE-2005-0058

URL: http://www.microsoft.com/technet/Security/bulletin/ms05-040.mspx

Short Name

SMB:OF:TAPI-SVC-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: Microsoft TAPI Service Overflow

Extended Description

Affected Products

References

Found a potential security threat?