[NT] Memory Leak and DoS in NT4 RPC server

From: SecuriTeam (support_at_securiteam.com)
Date: 10/13/04

  • Next message: SecuriTeam: "[NT] Windows VDM #UD Local Privilege Escalation" 
    To: list@securiteam.com
Date: 13 Oct 2004 18:10:38 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Memory Leak and DoS in NT4 RPC server
    ------------------------------------------------------------------------

    SUMMARY

    Due to a flaw in the implementation of a standard RPC interface, attackers
    can retrieve large amounts of the memory from the address space of NT4 RPC
    servers. In addition to retrieving memory, it is possible to crash any NT4
    RPC server by asking for extremely large amounts of memory, the RPC server
    will attempt to read from inaccessible parts of memory, causing an
    exception, and the termination of the RPC server..

    DETAILS

    Affected Systems:
     * All NT4 systems running RPC servers

    Impact:
    Anonymous attackers can crash any RPC server. This includes the SAM and
    LSA, the main RPC service, the Server service, etc. Many applications are
    also based on RPC or support it, including Exchange and SQL Server.

    In addition to crashing servers, an attacker can read large amounts of
    memory from the address space of the servers. Depending on the server,
    this may result in the disclosure of sensitive information. For example,
    during testing against the LSA of an NT4 domain controller, the
    Administrator's password hash was retrieved.

    Recommendations:
    Install the patch from Microsoft:
    <http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx>
    http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0569>
    CAN-2004-0569

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:loveless@bindview.com> Todd
    Sabin.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Windows VDM #UD Local Privilege Escalation"

    Relevant Pages