# MA-056.092003: MyCERT Advisory - Microsoft RPCSS Vulnerabilities

**Date:** 12 Sep 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-056.092003  
**Advisory ID:** MA-056.092003

---

1.0 Description
#### 1.1 Overview
On the 11th September 2003, MyCERT had forwarded CERTCC advisory to our mailing list regarding the new advisory on the RPCSS Vulnerabilities in Microsoft Windows. In order to assist the Malaysian public further, this document provides several critical information, and incorporating new information on detection tools received today. We strongly urge all home-users and organization networks to take necessary steps to apply the relevant preventive measures.
Microsoft has published a security bulletin describing three vulnerabilities that affect numerous versions of Microsoft Windows. Two of these vulnerabilities are remotely exploitable buffer overflows that may allow an attacker to execute arbitrary code with system privileges. The third vulnerability may allow a remote attacker to cause a denial of service.
By exploiting either of the buffer overflow vulnerabilities, remote attackers may be able to execute arbitrary code with Local System privileges.
By exploiting the denial-of-service vulnerability, remote attackers may be able to disrupt the RPCSS service. This may result in general system instability and require a reboot.
#### 1.2 System Affected
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0, Terminal Server Edition
- Microsoft Windows 2000
- Microsoft Windows XP
- Microsoft Windows Server 2003
### 2.0 Preventive Measures
MyCERT strongly recommends all vulnerable systems are patched or have the DCOM disabled to prevent future exploits. Detail descriptions and preventive measures are described in the following documents:
Microsoft Security Bulletin MS03-039 contains the recommended preventive measures which includes filtering at network perimeters, host based firewalls, patches for NT, 2000, XP and Server 2003 and methods to disable DCOM.
http://www.microsoft.com/technet/security/bulletin/MS03 -039.asp
AusCERT Advisory AL-2003.15 -- Buffer Overrun In RPCSS Service Could Allow Code Execution (824146)
http://www.auscert.org.au/render.html?it=3427
CERT® Advisory CA-2003-23 RPCSS Vulnerabilities in Microsoft Windows
http://www.cert.org/advisories/CA-2003-23.html
### 3.0 Detection
Several tools have been released to detect vulnerable computers and some of the tools also include disabling of DCOM on the hosts.
1. Xfrpcss is built for bulk scanning of networks. It was designed to scan a specified IP range for vulnerable hosts. The MS03-039 patch slightly modifies the behavior of the system so that it can be assessed by non-invasive means:
http://www.iss.net/support/product\_utilities/Xfrpcss.php
2. Microsoft's Updated Scanner KB 824146 Scanning Tool to identify host computers that do not have the 823980 (MS03-026) and the 824146 (MS03-039) security patches installed:
http://support.microsoft.com/?kbid=827363
3. eEye's Updated Scanner which detects several RPC DCOM vulnerabilities and disable DCOM, and detects and disinfect from Blaster worm. (The free version does not disinfect and disable DCOM):
http://www.eeye.com/html/Research/Tools/RPCDCOM.html
4. Nessus NASL Script for scanning from a unix host to detect MS03-039 vulnerability on remote windows hosts:
http://cgi.nessus.org/plugins/dump.php3?id=11835