SMB: Microsoft Windows Server Service Crafted RPC Request

This signature detects attempts to exploit a known vulnerability in the Microsoft Windows Server service. A successful attack can lead to a buffer overflow and arbitrary remote code execution as SYSTEM. This vulnerability is being actively exploited in the wild by malware.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that affects RPC (Remote Procedure Call) handling in the Server service. An attacker could exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the complete compromise of vulnerable computers. This issue may be prone to widespread automated exploits. Attackers require authenticated access on Windows Vista and Server 2008 platforms to exploit this issue. This vulnerability affects Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

Affected Products

Avaya messaging_application_server,Microsoft windows_server_2008_for_itanium-based_systems

References

BugTraq: 31874

CVE: CVE-2008-4250

URL: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx http://msdn.microsoft.com/en-us/library/cc247258.aspx

Short Name

SMB:SERVER-SVC-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: Microsoft Windows Server Service Crafted RPC Request

Extended Description

Affected Products

References

Found a potential security threat?