Windows 2000 RPC DoS and privilege escalation

Malformed DCOM RemoteGetClassObject request causes RPC mapper service to crash. After RPC crashes, it's possible for local attacker to hijack epmapper pipe and impersonate local system...