[NT] Microsoft Distributed Transaction Coordinator DoS

From: support@securiteam.com
Date: 04/19/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Fri, 19 Apr 2002 19:24:43 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Microsoft Distributed Transaction Coordinator DoS
------------------------------------------------------------------------

SUMMARY

A flaw in the way MSDTC handles malformed packets could allow an attacker
to hang the service and exhaust resources on the Server.

DETAILS

Vulnerable systems:
 - Windows 2000 Server without MS02-018 patch

If an attacker sends 20200 NULL characters to the MSDTC service, which
listens on TCP port 3372, server resources are allocated poorly. This
attack can result in MSDTC.EXE spiking at 100% CPU usage, MSDTC refusing
connections and kernel resources being exhausted.

Vendor response:
The vendor was contacted on the 24th of October, 2001. On the 15th of
March, 2002 we received a private Hotfix, which corrected the issue. On
the 10th of April, 2002 the vendor released a public bulletin. On the 19th
of April, 2002 the vendor notified us that the patch also included the
patched binary for the MSDTC issue.

Corrective action:
The vendor has released a patched binary, which is included in the
security rollup package MS02-018, available here:
 <http://www.microsoft.com/technet/security/bulletin/ms02-018.asp>
http://www.microsoft.com/technet/security/bulletin/ms02-018.asp

ADDITIONAL INFORMATION

The information has been provided by <mailto:pgrundl@kpmg.dk> Peter
Gründl.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] Wonderware SuiteLink Denial of Service Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Vendor Information, Solutions and Workarounds ... Core sends the advisory draft to Wonderware support team. ...
    (Securiteam)
  • [Full-Disclosure] Security Industry Under Scrutiny: Part 3
    ... > varying degrees of 'faith' in the security industry. ... site admins and other whitehats. ... > architect would be notifying the software vendor alone... ... Full disclosure isn't so much a tool to get vunerability information ...
    (Full-Disclosure)
  • [NT] Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass (MS0
    ... Get your security news from a reliable source. ... Internet Explorer Zone Elevation Restrictions Bypass and Security Zone ... Vendor Information, Solutions and Workarounds: ... Core sends an advisory ...
    (Securiteam)
  • RE: Vendor wants remote control of our Servers and Workstations
    ... Of course the age-old problem with security is that ... Vendor has significant access to your internal ... this vendor uses the same method to support a number ... customer and makes significant changes ... ...
    (Security-Basics)
  • Security researchers organization
    ... of security researchers, plain and simple. ... better than the vendor itself. ... industry, telecommunications industry and banking industry has ( ... These are all common ideals we can agree and act upon, ...
    (NT-Bugtraq)