Microsoft Remote Procedure Call (RPC) Server Vulnerability
Privacy and Legal Notice
INFORMATION BULLETIN
L-126: Microsoft Remote Procedure Call (RPC) Server Vulnerability
[Microsoft Security Bulletin MS01-041]
July 30, 2001 17:00 GMT
|
| PROBLEM: |
A malformed RPC request can cause a denial of service.
|
| PLATFORM: |
Those running any of the following products:
- Microsoft Exchange Server 5.5
- Microsoft Exchange Server 2000
- Microsoft SQL Server 7.0
- Microsoft SQL Server 2000
- Microsoft Windows NT 4.0
- Microsoft Windows 2000
|
| DAMAGE: |
The level of damage could range from minor (e.g., the service temporarily hanging) to major (e.g., the service failing in a way that would require the entire system to be restarted).
|
| SOLUTION: |
Apply the patches and proper firewalling as indicated in the bulletin.
|
|
VULNERABILITY
ASSESSMENT: |
The risk is LOW. Proper firewalling would help minimize the possibility of attacks by Internet-based users.
|
|
[***** Start Microsoft Security Bulletin MS01-041 *****]
- ----------------------------------------------------------------------
Title: Malformed RPC Request Can Cause Service Failure
Date: 26 July 2001
Software: Exchange Server 5.5, Exchange Server 2000,
SQL Server 7.0, SQL Server 2000, Windows NT 4.0,
Windows 2000
Impact: Denial of service
Bulletin: MS01-041
Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-041.asp
- ----------------------------------------------------------------------
Issue:
======
Several of the RPC servers associated with system services in
Microsoft Exchange, SQL Server, Windows NT 4.0 and Windows 2000 do not
adequately validate inputs, and in some cases will accept invalid
inputs that prevent normal processing. The specific input values at
issue here vary from RPC server to RPC server.
An attacker who sent such inputs to an affected RPC server could
disrupt its service. The precise type of disruption would depend on
the specific service, but could range in effect from minor (e.g., the
service temporarily hanging) to major (e.g., the service failing in a
way that would require the entire system to be restarted).
Mitigating Factors:
====================
- Proper firewalling would help minimize an affected system's
exposure to attack by Internet-based users. In general, a
firewall should block access to all RPC services except
those that are specifically intended for use by untrusted users.
Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms01-041.asp
for information on obtaining this patch.
Acknowledgment:
===============
- Bindview's Razor Team (http://razor.bindview.com)
- ---------------------------------------------------------------------
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY
FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY
NOT APPLY.
[***** End Microsoft Security Bulletin MS01-041 *****]
CIAC wishes to acknowledge the contributions of Microsoft for the
information contained in this bulletin.
DOE-CIRC can be contacted at:
Voice: +1 866-941-2472 (7 x 24)
E-mail: doecirc@doecirc.energy.gov
World Wide Web: http://www.doecirc.energy.gov/