Security Intelligence Operations

Microsoft Windows 2000 SP4 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with elevated privileges.

This vulnerability exists due to improper handling of malformed remote procedure call (RPC) requests by the Message Queuing Service (MSMQ). An unauthenticated, remote attacker could exploit this vulnerability by sending a malicious request to the affected system. If successful, the attacker could trigger the execution of arbitrary code with the privileges of the user.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Windows 2000 SP4 and prior are affected.

To exploit the vulnerability, the attacker requires network access to an affected system. Systems running host-based firewall applications may be protected from exploitation. Attackers also likely require access to internal network segments in order to reach affected systems through perimeter network filtering devices.

Only systems with the affected component are vulnerable. The MSMQ component is not installed by default, making widespread exploitation of the vulnerability less likely.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008

The update available from Microsoft corrects the vulnerability by correcting the way that RPC requests are processed.

Microsoft has released a security bulletin at the following link: MS08-065