| VID |
26039 |
| Severity |
30 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The hotfix (Q331953) for the "Flaw(DOS) in RPC Endpoint Mapper" is not applied.
Remote Procedure Call (RPC) provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. The failure results because of incorrect handling of malformed messages. By sending a specifically malformed packet to the RPC Endpoint Mapper at TCP port 135, remote attackers could the RPC service to cause a denial of service (disabled RPC service).
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* Platforms Affected:
Microsoft Windows NT 4
Microsoft Windows 2000
Microsoft Windows XP
* References:
http://www.securityfocus.com/archive/1/296114/2002-10-14/2002-10-20/0
http://www.microsoft.com/technet/security/bulletin/MS03-010.asp |
| Recommendation |
Apply the appropriate patch for your system, available from the Microsoft's download web site.
For Windows NT:
Although Windows NT 4.0 is affected by this vulnerability, Microsoft does not intend to release a patch. The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability. As a workaround, protect the NT 4.0 system with a firewall that blocks Port 135.
For Windows 2000 (All except Japanese NEC):
http://microsoft.com/downloads/details.aspx?FamilyId=BD55EB38-A5DE-4810-90F7-097C5B4B9919&displaylang=en
For Microsoft Windows 2000 (Japanese NEC):
http://microsoft.com/downloads/details.aspx?FamilyId=3F7DC0DA-A684-43A8-B2E3-1EEDEEDC822C&displaylang=ja
For Windows XP 32-bit Edition:
http://microsoft.com/downloads/details.aspx?FamilyId=94213569-3258-4439-9AE7-5D86813B4D9E&displaylang=en
For Windows XP 64-bit edition:
http://microsoft.com/downloads/details.aspx?FamilyId=E3FB88CF-FA48-4426-A4F8-D18D8D4D2295&displaylang=en |
| Related URL |
CVE-2002-1561 (CVE) |
| Related URL |
6005 (SecurityFocus) |
| Related URL |
(ISS) |
|
