[NT] Memory Leak and DoS in NT4 RPC server

From: SecuriTeam (support_at_securiteam.com)
Date: 10/13/04

  • Next message: SecuriTeam: "[NT] Windows VDM #UD Local Privilege Escalation" 
    To: list@securiteam.com
Date: 13 Oct 2004 18:10:38 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Memory Leak and DoS in NT4 RPC server
    ------------------------------------------------------------------------

    SUMMARY

    Due to a flaw in the implementation of a standard RPC interface, attackers
    can retrieve large amounts of the memory from the address space of NT4 RPC
    servers. In addition to retrieving memory, it is possible to crash any NT4
    RPC server by asking for extremely large amounts of memory, the RPC server
    will attempt to read from inaccessible parts of memory, causing an
    exception, and the termination of the RPC server..

    DETAILS

    Affected Systems:
     * All NT4 systems running RPC servers

    Impact:
    Anonymous attackers can crash any RPC server. This includes the SAM and
    LSA, the main RPC service, the Server service, etc. Many applications are
    also based on RPC or support it, including Exchange and SQL Server.

    In addition to crashing servers, an attacker can read large amounts of
    memory from the address space of the servers. Depending on the server,
    this may result in the disclosure of sensitive information. For example,
    during testing against the LSA of an NT4 domain controller, the
    Administrator's password hash was retrieved.

    Recommendations:
    Install the patch from Microsoft:
    <http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx>
    http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0569>
    CAN-2004-0569

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:loveless@bindview.com> Todd
    Sabin.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Windows VDM #UD Local Privilege Escalation"

    Relevant Pages

    • [NEWS] Null httpd Remote Resources Consumption (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The bug found in the Null httpd server is usually caused by unchecked ... * Memory consumption: if the server receives data from the client, ... server will finish all the available sockets and will be unreachable. ...
      (Securiteam)
    • [NEWS] WebMod Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WebMod Multiple Vulnerabilities ... which acts as a web server for Half-Life running on the equivalent TCP ... The functions in parser.cpp are affected by some memory corruption ...
      (Securiteam)
    • [NT] Multiple Vulnerabilities in HP Web JetAdmin (Read, Write, Execute, Path Disclosure, Password De
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HP Web JetAdmin is an enterprise management system for large amounts of HP ... The web server is a modular service ... HP Web JetAdmin uses it's own encryption. ...
      (Securiteam)
    • [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were discovered in the (Oracle database server ... password is required to exploit this vulnerability. ...
      (Securiteam)
    • [NEWS] ColdFusion MX Oversize Error Message DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ColdFusion MX "is the solution for building and deploying powerful web ... shoots up and stays there until the server completes writing the error ... a long string of data as a GET or POST request to ...
      (Securiteam)