----- Original Message ----- Subject: New Vulnerability in Microsoft Systems (RPC II)
Dear Barry Murphy,
Vulnerability in Microsoft Windows Servers ------------------------------------------
Severity of Bug : CRITICAL Port / Service : Microsoft RPC
Versions Affected :
* Microsoft Windows NT Workstation 4.0 * Microsoft Windows NT Server 4.0 * Microsoft Windows NT Server 4.0, Terminal Server Edition * Microsoft Windows 2000 * Microsoft Windows XP * Microsoft Windows Server 2003
3 new bugs have been found in the Microsoft implementation of RPC. Although these bugs are also related to DCOM activation, they _are_not_ the same issue addressed in July.
Exploits for this (these) problems already exist in the wild, as both Denial of Service and remote compromise. This problem could possibly be more serious than the previous (http://www.microsoft.com/security/security_bulletins/ms03-026.asp) one, since Microsoft have _not_ ruled out exploitation of RPC via HTTP. (Simply filtering access to ports 135, 139, 445 & 593 will not ensure safety from exploitation)
Microsoft has an end-user write up of the problem here : http://www.microsoft.com/security/security_bulletins/ms03-039.asp
Patches may be downloaded here :
Windows 2000 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F4F66D56-E7CE-44C3- 8B94-817EA8485DD1&displaylang=en
Windows XP :
http://www.microsoft.com/downloads/details.aspx?FamilyId=5FA055AE-A1BA-4D4A- B424-95D32CFC8CBA&displaylang=en
Windows 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=51184D09-4F7E-4F7B- 87A4-C208E9BA4787&displaylang=en
SensePost suggest that the patch be applied as soon as possible.
Sincerely.
======================================================= SensePost Research research(a)sensepost.com http://www.sensepost.com (tel) +27 12 667 4737 =======================================================