Vulnerability

CERT-In Vulnerability Note CIVN-2010-0204
Microsoft Windows Remote Procedure Call (RPC) Memory Corruption Vulnerability

Original Issue Date:September 16, 2010

Severity Rating: MEDIUM

Systems Affected

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems

Overview

A vulnerability has been reported in Microsoft Windows Remote Procedure Call (RPC) which could be exploited by unauthenticated remote attackers to execute arbitrary code and take complete control of the affected system.

Description

Microsoft Remote Procedure Call (RPC) is a network programming standard which allows a programmer to create an application consisting of any number of procedures, some that execute locally and others that execute on remote computers via a network.

This issue is caused due to Microsoft Remote Procedure Call (RPC) client implementation improperly allocates memory while parsing specially crafted RPC responses. An attacker could exploit this vulnerability by convincing a victim to initiate an RPC Call to a maliciously hosted RPC server that is designed to exploit this vulnerability by sending a specially crafted RPC response.

Successfully exploitation of this vulnerability could result in complete compromise of an affected system in the security context of the RPC client application.

Workaround

Temporarily disable ASP on the IIS server
Disable FastCGI if not required
Install and use URL Scan.

Solution

Apply patches as mentioned in Microsoft Security bulletin MS10-066

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-066.mspx

References

Vupen
http://www.vupen.com/english/advisories/2010/2387

Secunia
http://secunia.com/advisories/41412/

Securityfocus
http://www.securityfocus.com/bid/43119/info

Securitytracker
http://securitytracker.com/alerts/2010/Sep/1024441.html

CVE Name
CVE-2010-2567

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India