Threat of the month: RPC hole

Share this article:

What is it?
The Server Service is a Windows remote procedure call (RPC) service that is crucial for Windows file-sharing networks over workgroups or domains. A vulnerability has been found allowing for remote attacks to take control of PCs via TCP ports 139 or 445.

How does it work?
The vulnerability exists in the Windows API call NetPathCanonicalize(), used by the Server Service. Insufficient bounds checking allows for maliciously formatted arguments to get placed in the API call, leading to a buffer overflow.

Should I be worried?
Yes. This is a serious vulnerability. The major mitigating factors are that personal firewalls are enabled by default for Windows XP SP2 and later machines, thwarting arbitrary access.

How can I prevent it?
Microsoft recommends installing the MS08-067 patch to address this issue while retaining full Windows functionality. In addition, firewalling TCP ports 139 and 445 from arbitrary network locations can prevent worms from attacking from the outside, and firewalls inside the network can be used to contain any worm outbreaks in enterprises. Updated AV tools can also be used to detect these worms on infected systems.

Share this article:

Sign up to our newsletters

More in Features

Following the framework: Government standards

Following the framework: Government standards

New government standards promise to address risk and improve online security for critical infrastructure, reports Karen Epper Hoffman.

HIPAA shake: Health care

HIPAA shake: Health care

Adherence to HIPAA, the national law that aims to protect patient information, is about to get trickier, reports Alan Earls.

Affecting the C-suite: The CSO's reputation in today's corporate environment

Affecting the C-suite: The CSO's reputation in today's ...

Those who occupy the C-suite all bow to one corporate god: Reputation, says Blackstone CISO Jay Leek. James Hale reports.