Threat of the month: RPC hole

Share this article:

What is it?
The Server Service is a Windows remote procedure call (RPC) service that is crucial for Windows file-sharing networks over workgroups or domains. A vulnerability has been found allowing for remote attacks to take control of PCs via TCP ports 139 or 445.

How does it work?
The vulnerability exists in the Windows API call NetPathCanonicalize(), used by the Server Service. Insufficient bounds checking allows for maliciously formatted arguments to get placed in the API call, leading to a buffer overflow.

Should I be worried?
Yes. This is a serious vulnerability. The major mitigating factors are that personal firewalls are enabled by default for Windows XP SP2 and later machines, thwarting arbitrary access.

How can I prevent it?
Microsoft recommends installing the MS08-067 patch to address this issue while retaining full Windows functionality. In addition, firewalling TCP ports 139 and 445 from arbitrary network locations can prevent worms from attacking from the outside, and firewalls inside the network can be used to contain any worm outbreaks in enterprises. Updated AV tools can also be used to detect these worms on infected systems.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in Features

Game theory: Cyber preparedness

Game theory: Cyber preparedness

Business leaders are beginning to fathom the importance of cyber war game simulation exercises, reports James Hale.

Forward progress: How the Denver Broncos really play defense

Forward progress: How the Denver Broncos really play ...

Off the field, demand for bandwidth and protection from network threats set the ball in motion for the Denver Broncos. Greg Masters reports.

Smart defense: A talk with industry veteran Gene Fredriksen

Smart defense: A talk with industry veteran Gene ...

Today's CISO must stay ahead of attackers, says Gene Fredriksen, CISO at PSCU. Teri Robinson talks one on one with the industry veteran.