Threat of the month: RPC hole

Share this article:

What is it?
The Server Service is a Windows remote procedure call (RPC) service that is crucial for Windows file-sharing networks over workgroups or domains. A vulnerability has been found allowing for remote attacks to take control of PCs via TCP ports 139 or 445.

How does it work?
The vulnerability exists in the Windows API call NetPathCanonicalize(), used by the Server Service. Insufficient bounds checking allows for maliciously formatted arguments to get placed in the API call, leading to a buffer overflow.

Should I be worried?
Yes. This is a serious vulnerability. The major mitigating factors are that personal firewalls are enabled by default for Windows XP SP2 and later machines, thwarting arbitrary access.

How can I prevent it?
Microsoft recommends installing the MS08-067 patch to address this issue while retaining full Windows functionality. In addition, firewalling TCP ports 139 and 445 from arbitrary network locations can prevent worms from attacking from the outside, and firewalls inside the network can be used to contain any worm outbreaks in enterprises. Updated AV tools can also be used to detect these worms on infected systems.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in Features

Transparency reports useful, but more info needed on 'digital searches'

Transparency reports useful, but more info needed on ...

Transparency reports are common these days, but the information they provide can still be difficult to read and understand.

Same battle, different field

Same battle, different field

Cyberwarfare is so new that the ground rules are still being established. Nazan Osman provides an overview.

Passwords are passé

Passwords are passé

New solutions are gaining traction to complement, or replace, the legacy use of username and password, reports Ashley Carman.