Security Best Practice: Protect Yourself from MS-RPC and DCE-RPC Vulnerabilities

DCE/RPC stands for "Distributed Computing Environment / Remote Procedure Calls". It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having...

MS Windows Server Service Code Execution Exploit (MS08-067) (2k/2k3)

No description provided by source. !/usr/bin/env python MS08-067 Exploit by Debasis Mohanty aka Tr0y/nopsled www.hackingspirits.com www.coffeeandsecurity.com Email: d3basis.m0hanty @ gmail.com import struct import sys from threading import Thread Thread is imported incase you would like to modify...

Trend Micro ServerProtect StRpcSrv.dll RPC接口不安全实现方式漏洞

BUGTRAQ ID: 26912 Trend ServerProtect是一款企业级反病毒程序。 ServerProtect的SpntSvc.exe守护程序处理请求数据时存在漏洞，远程攻击者可能利用此漏洞控制服务器。 ServerProtect中默认绑定到TCP 5168端口上的SpntSvc.exe守护程序通过TmRpcSrv.dll库暴露以下DCE/RPC接口： / opcode: 0x00, address: 0x65741030 / errorstatust sub65741030 in handlet arg1, in long arg2, insizeisarg4 byte...

Code injection

SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from StRpcSrv.dll in the DCE/RPC interface, which allows remote attackers to obtain "full file system access" and execute arbitrary code...

CVE-2007-6507: Undefined Security Weakness

SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from StRpcSrv.dll in the DCE/RPC interface, which allows remote attackers to obtain "full file system access" and execute arbitrary code...

ZDI-07-077: Trend Micro ServerProtect StRpcSrv.dll Insecure Method Exposure Vulnerability

ZDI-07-077: Trend Micro ServerProtect StRpcSrv.dll Insecure Method Exposure Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-077.html December 17, 2007 -- CVE ID: -- Affected Vendor: Trend Micro -- Affected Products: ServerProtect v5.58 -- TippingPointTM IPS Customer Protection:...

Trend Micro ServerProtect StRpcSrv.dll Insecure Method Exposure Vulnerability

These vulnerabilities allow attackers to execute arbitrary code on vulnerable installations of Trend Micro ServerProtect. Authentication is not required to exploit these vulnerabilities. The specific flaw exists in the SpntSvc.exe daemon, bound by default on TCP port 5168 and exposing the followi...

Buffer overflow

Buffer overflow in the swrpcagentinit function in swagentd in Software Distributor SD, and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request...

CVE-2007-6195

Buffer overflow in the swrpcagentinit function in swagentd in Software Distributor SD, and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request...

Bind Acks with Invalid Return Ports

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Invalid Bind ACK Messages

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Non Standard MS-RPC Message Types

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Stateful Inspection of Alter Context Messages

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Snort DCE/RPC preprocessor buffer overflow

Added: 07/09/2007 CVE: CVE-2006-5276 BID: 22616 OSVDB: 32094 Background Snort is an open-source intrusion detection system. It includes a DCE/RPC preprocessor, which reassembles DCE/RPC traffic before it is passed to the intrusion detection engine. Problem A buffer overflow vulnerability in the...

Snort DCE/RPC preprocessor buffer overflow

Added: 07/09/2007 CVE: CVE-2006-5276 BID: 22616 OSVDB: 32094 Background Snort is an open-source intrusion detection system. It includes a DCE/RPC preprocessor, which reassembles DCE/RPC traffic before it is passed to the intrusion detection engine. Problem A buffer overflow vulnerability in the...

Snort DCE/RPC preprocessor buffer overflow

Added: 07/09/2007 CVE: CVE-2006-5276 BID: 22616 OSVDB: 32094 Background Snort is an open-source intrusion detection system. It includes a DCE/RPC preprocessor, which reassembles DCE/RPC traffic before it is passed to the intrusion detection engine. Problem A buffer overflow vulnerability in the...

Trend Micro ServerProtect EarthAgent.exe远程栈缓冲区溢出漏洞

Trend ServerProtect是一款企业级反病毒程序。 Trend ServerProtect的DCE/RPC接口实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 ServerProtect默认绑定在TCP 3628端口上的EarthAgent.exe守护程序通过TmRpcSrv.dll暴露以下DCE/RPC接口： / opcode: 0x00, address: 0x65741030 / errorstatust sub65741030 in handlet arg1, in long arg2, insizeisarg4 byte arg3, in long...

ZDI-07-025: Trend Micro ServerProtect AgRpcCln.dll Stack Overflow Vulnerability

ZDI-07-025: Trend Micro ServerProtect AgRpcCln.dll Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-025.html May 7, 2007 -- CVE ID: CVE-2007-2508 -- Affected Vendor: Trend Micro -- Affected Products: ServerProtect v5.58 -- TippingPointTM IPS Customer Protection:...

Trend Micro ServerProtect AgRpcCln.dll Stack Overflow Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Trend Micro ServerProtect. Authentication is not required to exploit this vulnerability. The specific flaw exists in the SpntSvc.exe daemon, bound by default on TCP port 5168 and exposing the following...

Trend Micro ServerProtect EarthAgent Stack Overflow Vulnerability

These vulnerabilities allow attackers to execute arbitrary code on vulnerable installations of Trend Micro ServerProtect. Authentication is not required to exploit these vulnerabilities. The specific flaw exists in the EarthAgent.exe daemon, bound by default on TCP port 3628 and exposing the...