Vulnerability Note VU#261537

Microsoft Windows RPC service vulnerable to DoS via NULL pointer dereference

A vulnerability exists in a part of the RPC service called the RPC Endpoint Mapper. The RPC Endpoint Mapper listens for network requests (135/tcp), provides clients with port numbers for RPC services, and maintains information about RPC connections. According to a report from Immunity Security, vulnerable code in the RPC Endpoint Mapper dereferences a NULL pointer when processing a malformed RPC message.

II. Impact

Once the RPC service has been terminated, an attacker may be able to take control over an orphaned named pipe and gain the privileges of the RPC service (Local System).

III. Solution

Apply the appropriate patch (Q331953) as specified in MS03-010. Microsoft notes that a patch will not be produced for Windows NT 4.0 or Windows NT 4.0 Terminal Server Edition.
The patches may cause local COM calls to fail, which could affect ASP/COM+ applications. See Microsoft Knowledgebase Article 814119 for more information.

Block or Restrict Access

Block or restrict access to the RPC Endpoint Mapper service (135/tcp) from untrusted networks such as the Internet.

Systems Affected

http://www.immunitysec.com/vulnerabilities/Immunity_svchost_DoS.txt
http://www.securityfocus.com/bid/6005
http://www.securityfocus.com/bid/6769
http://www.securityfocus.com/archive/1/296114
http://www.microsoft.com/technet/security/bulletin/MS03-010.asp
http://support.microsoft.com/default.aspx?scid=kb;en-us;331953
http://support.microsoft.com/?kbid=814119
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/rpc/rpc/how_rpc_works.asp

Credit

This vulnerability was publicly reported by Dave Aitel of Immunity Security.

This document was written by Art A Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.