-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                        AL-2003.20 -- AUSCERT ALERT
              Microsoft RPC Race Condition Denial of Service
                            ISS Security Brief
                              15 October 2003
===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:                Distributed Component Object Model (DCOM) / 
                        Remote Procedure Call (RPC) Service
Publisher:              Internet Security Systems (ISS) X-Force
Operating System:       Windows XP
                        Windows 2000
Impact:                 Denial of Service
Access Required:        Remote

Ref:                    AL-2003.15
                        AL-2003.11
                        AU-2003.014

Another vulnerability has been discovered in Microsoft RPC (DCOM)
services which is not patched by MS03-026 or MS03-039. Publicly available
exploit code, which expands upon that described in AU-2003.014 (see
Ref:), has been released which exploits this vulnerability causing a
denial of service on Windows XP and 2000 systems patched with MS03-026 or
MS03-039. The same exploit code will compromise systems that have not
been updated with MS03-026 and MS03-039 patches.

Until patches are available for this new vulnerability, the following
workarounds can be used to reduce possible attack exposure. These
workarounds may have an adverse affect network and application operations
and as such should be researched and tested before making changes to
production systems.

o Use a network or host-based/personal firewalls, block RPC network
  traffic (ports 135/tcp, 139/tcp, 445/tcp, 593/tcp and 135/udp,
  137/udp, 138/udp, 445/udp).

o Disable COM Internet Services (CIS) and RPC over HTTP as per
  Microsoft Knowledge Base Article 825819:

    http://support.microsoft.com/default.aspx?scid=825819

o Disable DCOM as detailed in Microsoft Knowledge Base Article 825750:

    http://support.microsoft.com/default.aspx?scid=825750

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

Internet Security Systems Security Brief
October 14, 2003

Microsoft RPC Race Condition Denial of Service

Synopsis:

ISS X-Force has discovered a flaw in the Microsoft RPC service during a
routine audit that may allow remote attackers to trigger a Denial of
Service (DoS) condition on vulnerable hosts. This vulnerability exists in
the most current patch-levels of the Windows operating systems, including
computers patched against the issues described in Microsoft Security
Bulletin MS03-039. This vulnerability has been reported by various sources
as a new exploit vector against the vulnerability disclosed in MS03-039.
This assessment is incorrect. The vulnerability described in this Advisory
manifests as a result of a separate multi-threaded race condition when
processing incoming RPC requests.

Impact:

X-Force has demonstrated that a DoS vulnerability exists by exploiting the
race condition. Attackers can take advantage of this vulnerability by
crashing the Microsoft RPC service, and/or forcing vulnerable systems to
reboot. X-Force has not demonstrated that this vulnerability can be used
to execute arbitrary code or to compromise a vulnerable system.
Significant  barriers exist which may prevent reliable exploitation
outside of controlled lab conditions.

Affected Versions:

Microsoft Windows 2000
Microsoft Windows XP

For the complete ISS X-Force Security Advisory, please visit: 
http://xforce.iss.net/xforce/alerts/id/155

______ 

About Internet Security Systems (ISS) 
Founded in 1994, Internet Security Systems (ISS) (Nasdaq: ISSX) is a 
pioneer and world leader in software and services that protect critical 
online resources from an ever-changing spectrum of threats and misuse. 
Internet Security Systems is headquartered in Atlanta, GA, with 
additional operations throughout the Americas, Asia, Australia, Europe 
and the Middle East. 

Copyright (c) 2003 Internet Security Systems, Inc. All rights reserved 
worldwide. 

Permission is hereby granted for the electronic redistribution of this 
document. It is not to be edited or altered in any way without the 
express written consent of the Internet Security Systems X-Force. If you 
wish to reprint the whole or any part of this document in any other 
medium excluding electronic media, please email xforce@iss.net for 
permission. 

Disclaimer: The information within this paper may change without notice. 
Use of this information constitutes acceptance for use in an AS IS 
condition. There are NO warranties, implied or otherwise, with regard to 
this information or its use. Any use of this information is at the 
user's risk. In no event shall the author/distributor (Internet Security 
Systems X-Force) be held liable for any damages whatsoever arising out 
of or in connection with the use or spread of this information. 
X-Force PGP Key available on MIT's PGP key server and PGP.com's key server, 
as well as at http://www.iss.net/security_center/sensitive.php 
Please send suggestions, updates, and comments to: X-Force 
xforce@iss.net of Internet Security Systems, Inc. 

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBP4xASjRfJiV99eG9AQFKPgP/SBfoVnOM1Vzg8mteT4sq80FzH7YdlkhL
v5Sd7b9w7wUF1/FCWRTN1yDSWEk7Yo3BstSjvmqFMFd6zOtD+RLqVB/9CROj2Cr7
7P03Jr2/zcS3YDbRwhGB0gfkv2ysxdnWLx4pKnheCtMYkOzCALxpLcqI5W/1gimO
SoCs4qyPhoI=
=k2ZS
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This alert is provided as a service to AusCERT's members.  As AusCERT did
not write the document quoted above, AusCERT has had no control over its   
content. The decision to follow or act on information or advice contained in
this security bulletin is the responsibility of each user or organisation, and 
should be considered in accordance with your organisation's site policies and 
procedures. AusCERT takes no responsibility for consequences which may arise 
from following or acting on information or advice contained in this security 
bulletin.

NOTE: This is only the original release of the alert.  It may not be
updated when updates to the original are made.  If downloading at a later
date, it is recommended that the alert is retrieved directly from the
author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the alert above.  If you have any questions or need further information,
please contact them directly.

Previous advisories, alerts and external security bulletins can be 
retrieved from:

        http://www.auscert.org.au/render.html?cid=1977

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business
                hours which are GMT+10:00 (AEST).  On call after hours
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBP4yKCSh9+71yA2DNAQEeTwQAl3V56BECBPTv8KFrxCk7PQvvfqBqRHz7
GQIz6agaBBBkQxpcON2n25k5cj4gy+mhzxHLfV8UuXrcYmUFCwO1L6GFz4a+jsWT
rMV6t61CqnSWfXwiMQ6sWdVIrQrrH6NUL8QQPzk4zo7FRwRDv3SgjCbqO2OMgrAK
6hIpoPUTgtI=
=nfgT
-----END PGP SIGNATURE-----