Flaw in RPC Endpoint Mapper New

A security vulnerabiliy in the Remote Procedure Call (RPC) endpoint mapper in Windows NT 4.0, 2000 and XP could allows a remote attacker to cause a denial of service by transmitting a malformed RPC message.

Issue

Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the OSF (Open Software Foundation) RPC protocol, but with the addition of some Microsoft specific extensions.

There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. The failure results because of incorrect handling of malformed messages. This particular vulnerabilty affects the RPC Endpoint Mapper process, which listens on TCP/IP port 135. The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service.

To exploit this vulnerability, an attacker would need to establish a TCP/IP connection to the Endpoint Mapper process on a remote machine. Once the connection was established, the attacker would begin the RPC connection negotiation before transmitting a malformed message. At this point, the process on the remote machine would fail. The RPC Endpoint Mapper process is responsible for maintaining the connection information for all of the processes on that machine using RPC. Because the Endpoint Mapper runs within the RPC service itself, exploiting this vulnerability would cause the RPC service to fail, with the attendant loss of any RPC-based services the server offers, as well as potential loss of some COM functions.

Affected Products

• Microsoft Windows NT 4
• Microsoft Windows 2000
• Microsoft Windows XP

Download

Software patches are available from the following locations:

• Microsoft Windows 2000
• Microsoft Windows XP

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: March 26, 2003

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<