{"vuid":"VU#261537","idnumber":"261537","name":"Microsoft Windows RPC service vulnerable to DoS via NULL pointer dereference","keywords":["Microsoft","Windows 2000","DCE-RPC stack","DoS","denial of service","null pointer dereference","end point mapper","epm","ms03-010"],"overview":"The RPC service in Microsoft Windows NT 4.0, 2000, and XP can be terminated by a specially crafted RPC message. A remote attacker could cause a denial of service.","clean_desc":"According to Microsoft Security Bulletin MS03-010, \"Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system.\"\nA vulnerability exists in a part of the RPC service called the RPC Endpoint Mapper. The RPC Endpoint Mapper listens for network requests (135/tcp), provides clients with port numbers for RPC services, and maintains information about RPC connections. According to a report from Immunity Security, vulnerable code in the RPC Endpoint Mapper dereferences a NULL pointer when processing a malformed RPC message.","impact":"An unauthenticated, remote attacker could cause the RPC Endpoint Mapper to terminate, denying service to legitimate users. Since the RPC Endpoint Mapper is part of the RPC service, \"...exploiting this vulnerability would cause the RPC service to fail, with the attendant loss of any RPC-based services the server offers, as well as potential loss of some COM functions.\"\nOnce the RPC service has been terminated, an attacker may be able to take control over an orphaned named pipe and gain the privileges of the RPC service (Local System).","resolution":"Apply Patch\nApply the appropriate patch (Q331953) as specified in MS03-010. Microsoft notes that a patch will not be produced for Windows NT 4.0 or Windows NT 4.0 Terminal Server Edition. The patches may cause local COM calls to fail, which could affect ASP/COM+ applications. See Microsoft Knowledgebase Article 814119 for more information.","workarounds":"Block or Restrict Access Block or restrict access to the RPC Endpoint Mapper service (135/tcp) from untrusted networks such as the Internet.","sysaffected":"","thanks":"This vulnerability was publicly reported by Dave Aitel of \nImmunity Security","author":"This document was written by Art A Manion.","public":["http://www.immunitysec.com/vulnerabilities/Immunity_svchost_DoS.txt","http://www.securityfocus.com/bid/6005","http://www.securityfocus.com/bid/6769","http://www.securityfocus.com/archive/1/296114","http://www.microsoft.com/technet/security/bulletin/MS03-010.asp","http://support.microsoft.com/default.aspx?scid=kb;en-us;331953","http://support.microsoft.com/?kbid=814119","http://msdn.microsoft.com/library/default.asp?url=/library/en-us/rpc/rpc/how_rpc_works.asp"],"cveids":["CVE-2002-1561"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-10-18T20:19:03Z","publicdate":"2002-10-18T00:00:00Z","datefirstpublished":"2003-03-26T23:02:46Z","dateupdated":"2003-06-04T18:13:01Z","revision":22,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"7","cam_population":"15","cam_impact":"13","cam_easeofexploitation":"16","cam_attackeraccessrequired":"15","cam_scorecurrent":"23.6925","cam_scorecurrentwidelyknown":"23.6925","cam_scorecurrentwidelyknownexploited":"41.2425","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":23.6925,"vulnote":null}