Signature Detail

MS-RPC: NetrLogonGetDomainInfo NULL Pointer

This signature detects attempts to exploit a known vulnerability against Microsoft Windows MS-RPC NetrLogonGetDomainInfo. A successful attack can result in a denial-of-service condition on most architecture. On some ARM architecture this could result in code execution.

Extended Description

Microsoft Windows is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to restart the affected server, denying service to legitimate users. NOTE: A remote attacker must have administrator privileges on a machine in the same domain to leverage this issue.

Affected Products

• Microsoft Windows Server 2003 SP2
• Microsoft Windows Server 2003 Itanium SP2
• Microsoft Windows Server 2003 x64 SP2
• Microsoft Windows Server 2008 for 32-bit Systems SP2
• Microsoft Windows Server 2008 for 32-bit Systems
• Microsoft Windows Server 2008 for Itanium-based Systems R2
• Microsoft Windows Server 2008 for Itanium-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems R2
• Microsoft Windows Server 2008 for x64-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems
• Microsoft Windows Server 2008 R2 Itanium

References

• BugTraq: 45271
• CVE: CVE-2010-2742