The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Memory Leak and DoS in NT4 RPC server
------------------------------------------------------------------------
SUMMARY
Due to a flaw in the implementation of a standard RPC interface, attackers
can retrieve large amounts of the memory from the address space of NT4 RPC
servers. In addition to retrieving memory, it is possible to crash any NT4
RPC server by asking for extremely large amounts of memory, the RPC server
will attempt to read from inaccessible parts of memory, causing an
exception, and the termination of the RPC server..
DETAILS
Affected Systems:
* All NT4 systems running RPC servers
Impact:
Anonymous attackers can crash any RPC server. This includes the SAM and
LSA, the main RPC service, the Server service, etc. Many applications are
also based on RPC or support it, including Exchange and SQL Server.
In addition to crashing servers, an attacker can read large amounts of
memory from the address space of the servers. Depending on the server,
this may result in the disclosure of sensitive information. For example,
during testing against the LSA of an NT4 domain controller, the
Administrator's password hash was retrieved.
Recommendations:
Install the patch from Microsoft:
<http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx>
http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0569>
CAN-2004-0569
ADDITIONAL INFORMATION
The information has been provided by <mailto:loveless@bindview.com> Todd
Sabin.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
