Threat of the month: RPC hole
What is it?
The Server Service is a Windows remote procedure call (RPC) service that is crucial for Windows file-sharing networks over workgroups or domains. A vulnerability has been found allowing for remote attacks to take control of PCs via TCP ports 139 or 445.
How does it work?
The vulnerability exists in the Windows API call NetPathCanonicalize(), used by the Server Service. Insufficient bounds checking allows for maliciously formatted arguments to get placed in the API call, leading to a buffer overflow.
Should I be worried?
Yes. This is a serious vulnerability. The major mitigating factors are that personal firewalls are enabled by default for Windows XP SP2 and later machines, thwarting arbitrary access.
How can I prevent it?
Microsoft recommends installing the MS08-067 patch to address this issue while retaining full Windows functionality. In addition, firewalling TCP ports 139 and 445 from arbitrary network locations can prevent worms from attacking from the outside, and firewalls inside the network can be used to contain any worm outbreaks in enterprises. Updated AV tools can also be used to detect these worms on infected systems.
