Signature Detail
Short Name |
MS-RPC:INV:DNS-SVC |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
MS-RPC |
Keywords |
Microsoft Windows Invalid DNS Service |
Release Date |
2010/04/22 |
Update Number |
1663 |
Supported Platforms |
idp-4.1.110110609+, isg-3.5.141421+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
MS-RPC: Microsoft Windows Invalid DNS Service
This signature detects attempts to exploit a known vulnerability against Microsoft Windows DNS Service RPC Interface. A successful attack can lead to arbitrary code execution.
Extended Description
Microsoft Windows Domain Name System (DNS) Server Service is prone to a stack-based buffer-overflow vulnerability in its Remote Procedure Call (RPC) interface. A remote attacker may exploit this issue to run arbitrary code in the context of the DNS Server Service. The DNS service runs in the 'SYSTEM' context. Successfully exploiting this issue allows attackers to execute arbitrary code, facilitating the remote compromise of affected computers. Windows Server 2000 Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2 are confirmed vulnerable to this issue. Microsoft Windows 2000 Professional SP4, Windows XP SP2, and Windows Vista are not affected by this vulnerability.
Affected Products
- Microsoft Small Business Server 2000
- Microsoft Small Business Server 2003
- Microsoft Small Business Server 2003 Premium Edition
- Microsoft Windows 2000 Server SP4
- Microsoft Windows Server 2003 SP1
- Microsoft Windows Server 2003 SP2
- Microsoft Windows Server 2003 Datacenter x64 Edition SP2
- Microsoft Windows Server 2003 Enterprise x64 Edition SP2
- Microsoft Windows Server 2003 Itanium SP1
- Microsoft Windows Server 2003 Itanium SP2
- Microsoft Windows Server 2003 x64 SP1
- Microsoft Windows Server 2003 x64 SP2
References
- BugTraq: 23470
- CVE: CVE-2007-1748