Signature Detail

MS-RPC: Microsoft Distributed Transaction Coordinator Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Distributed Transaction Coordinator (msdtc.exe) process. A successful exploit can result in remote code execution with System privileges. You should use this signature to examine Internet-facing connections.

Extended Description

The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.

Affected Products

• Microsoft windows_2000 (sp4:)
• Microsoft windows_2000 (sp4)
• Microsoft windows_2000 (sp4::fr)
• Microsoft windows_2003_server 64-bit
• Microsoft windows_2003_server itanium
• Microsoft windows_2003_server r2
• Microsoft windows_2003_server sp1
• Microsoft windows_2003_server sp1 (:itanium)
• Microsoft windows_xp (:64-bit)
• Microsoft windows_xp (sp1)
• Microsoft windows_xp (sp1:tablet_pc)
• Microsoft windows_xp (sp2)
• Microsoft windows_xp (sp2:tablet_pc)

References

• BugTraq: 15056
• CVE: CVE-2005-2119
• URL: http://www.microsoft.com/technet/security/bulletin/MS05-051.mspx
• URL: http://www.kb.cert.org/vuls/id/180868
• URL: http://www.us-cert.gov/cas/techalerts/TA05-284A.html