Title: Malformed Request to RPC Endpoint Mapper can cause RPC Service to fail
Date: 10th September 2001
Software: Microsoft(r) Windows NT 4.0
Impact: Denial of service If you're running WinNT4 you should Read More... Issue: The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service. The Windows NT 4.0 endpoint mapper contains a flaw that causes it to fail upon receipt of a request that contains a particular type of malformed data. Because the endpoint mapper runs within the RPC service itself, exploiting this vulnerability would cause the RPC service itself to fail, with the attendant loss of any RPC-based services the server offers, as well as potential loss of some COM functions. Normal service could be restored by rebooting the server. Mitigating Factors: - Standard security recommendations call for port 135 - the port on which the RPC endmapper operates - to be blocked at the firewall. If this were done, Internet-based attackers would not be able to exploit this vulnerability. Patch Availability: - A patch is available to fix this vulnerability. Please read the Security Bulletin at Microsoft Security Bulletin MS01-048 for information on obtaining this patch.
Date: 10th September 2001
Software: Microsoft(r) Windows NT 4.0
Impact: Denial of service If you're running WinNT4 you should Read More... Issue: The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service. The Windows NT 4.0 endpoint mapper contains a flaw that causes it to fail upon receipt of a request that contains a particular type of malformed data. Because the endpoint mapper runs within the RPC service itself, exploiting this vulnerability would cause the RPC service itself to fail, with the attendant loss of any RPC-based services the server offers, as well as potential loss of some COM functions. Normal service could be restored by rebooting the server. Mitigating Factors: - Standard security recommendations call for port 135 - the port on which the RPC endmapper operates - to be blocked at the firewall. If this were done, Internet-based attackers would not be able to exploit this vulnerability. Patch Availability: - A patch is available to fix this vulnerability. Please read the Security Bulletin at Microsoft Security Bulletin MS01-048 for information on obtaining this patch.
