Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message.
Impact
Run code of attacker's choice
Must:
System Administrators should immediately apply the relevant patch from Microsoft site.
Optional:
The System Administrator may wish to block access from outside his/her network perimeter, specifically by blocking access to TCP & UDP ports 135, 139, and 445. This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of network to exploit the vulnerability. It is important to understand his/her network's configuration and service requirements before deciding what changes are appropriate.
The System Administrator Check the TCP and UDP ports which are open by giving netstat -a -n command from going to command mode.
If DCOM-RPC services or application are not running in environment, the System Administrator may stop TCP and UDP ports from Start/Networks and Dial-up connections/Local Area Connection/Properties/Internet Protocol TCP/IP Properties /Advanced../Options/TCP-IP filtering/Properties
The System Administrator may recheck the TCP and UDP ports now opened condition by typing netstat -a -n again from command prompt.
The information provided herein is on "as is" basis, without warranty of any kind.