10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.969 High
EPSS
Percentile
99.7%
The Microsoft DNS service Remote Procedure Call (RPC) implementation contains a stack buffer overflow. This vulnerability may allow a remote attacker to execute arbitrary code with SYSTEM
privileges.
The Microsoft Windows DNS service uses RPC to facilitate remote management. The Microsoft Windows DNS service RPC management interface contains a stack-based buffer overflow. This vulnerability can be triggered by sending a specially crafted RPC packet to the RPC management interface. The management interface typically operates on a dynamically-assigned port between 1024/tcp and 5000/tcp.
This vulnerability can also be exploited via the ports used by SMB services (139/tcp, 139/udp, 445/tcp, and 445/udp). However, this attack vector requires valid authentication credentials.
More information on this vulnerability, including a list of affected products is available in Microsoft Security Bulletin MS07-029.
Exploit code for this vulnerability is publicly available, and it is being actively exploited.
A remote attacker may be able to execute arbitrary code with SYSTEM
privileges.
Apply an update
This vulnerability is addressed by the updates included with Microsoft Security Bulletin MS07-029.** **
Until an update can be applied, the following workarounds may reduce the chances of exploitation. It is important to understand your network’s configuration and service requirements before deciding what changes are appropriate. For instance, disabling the RPC interface of the DNS service may prevent administrators from being able to remotely manage a Microsoft Windows DNS server. Consider this when implementing the following workarounds:
Disable the RPC interface used by the Microsoft Windows DNS service
This workaround will configure the DNS management service to to function only via Local Procedure Call (LPC). This prevents exploitation of the vulnerability, however it also disables remote management via RPC, which is used by the Microsoft Management Console (MMC) DNS snap-in.
According to Microsoft SecurityBulletin MS07-029, the RPC remote management can be disabled by taking the following steps:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
”..REG
file and imported:Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters]
"RpcProtocol"=dword:00000004
This will restrict the DNS management interface to Local Procedure Call (LPC) only. Note that the DNS service needs to be restarted for the above changes to take effect. More information on regedit.exe
is available in Microsoft Knowledge Base Article Q82821.
Additional information regarding how to disable remote administration of the DNS Server service in Windows Server 2003 and in Windows 2000 Server can be found in Microsoft Knowledge Base Article 936263.
Block or Restrict access to RPC at the network perimeter
This workaround will restrict TCP/IP access to all RPC interfaces, including the vulnerable DNS management RPC interface. This workaround will not prevent exploitation of the vulnerability, but will limit the possible sources of attacks. This workaround will allow remote management using the RPC interface (MMC DNS Snap-in) from selected networks.
Access to the RPC Endpoint Mapper service (135/tcp), the ports assigned by the RPC Endpoint Mapper (by default 1024/tcp to 5000/tcp), and SMB services (139/tcp, 139/udp, 445/tcp, and 445/udp) should be blocked at your network perimeter. This will limit your exposure to attacks. Note that blocking RPC and SMB at the network perimeter will still allow attackers within the perimeter of your network to exploit this vulnerability.
All unsolicited traffic on the ports listed above should be blocked.
555920
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: May 08, 2007
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Refer to Microsoft Security Bulletin MS07-029.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23555920 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was reported in Microsoft Security Advisory (935964).
This document was written by Jeff Gennari.
CVE IDs: | CVE-2007-1748 |
---|---|
Severity Metric: | 49.14 Date Public: |
blogs.technet.com/msrc/archive/2007/04/12/microsoft-security-advisory-935964-posted.aspx
secunia.com/advisories/24871/
support.microsoft.com/kb/813963/
support.microsoft.com/kb/936263
support.microsoft.com/kb/q82821
www.microsoft.com/technet/security/advisory/935964.mspx
www.microsoft.com/technet/security/bulletin/ms07-029.mspx