vendor:
Windows
by:
SecurityFocus
7.5
CVSS
HIGH
Denial of Service
20
CWE
Product Name: Windows
Affected Version From: Windows 2000
Affected Version To: Windows XP
Patch Exists: YES
Related CWE: CVE-2002-0083
CPE: o:microsoft:windows
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, NT 4.0, XP
2002
Microsoft Windows RPC Service Denial of Service Vulnerability
The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the RPC service will be disabled. This vulnerability was originally reported to only affect Windows 2000. Microsoft has confirmed that Windows NT 4.0 and XP are also vulnerable. It has been reported that installation of the provided patch will cause some problems in IIS environments. Specifically, users who are using COM+ in IIS environments may experience problems with ASP transactions. A variant of this issue has been reported which allegedly affects patched systems. It is apparently possible to trigger this variant by flooding a system with malformed packets.
Mitigation:
Install the provided patch from Microsoft.
