|
Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
Solution: eEye has released a free scanning tool for administrators to detect systems vulnerable to this issue. Please check the references section for a link to download this utility. ** Several reports state that the RPC/DCOM service may still be vulnerable to a denial of service attack even if the Microsoft-supplied patch has been applied. Microsoft has released patches to address this issue. Note that Windows NT 4.0 Workstation reached its end of life on June 30th, 2003. Because of this, Microsoft has not released a supported NT 4.0 Workstation patch. The Windows NT 4.0 Server patch may work on NT 4.0 Workstation, however, this has not been tested nor is it supported by Microsoft. ** CERT/CC reported an unrelated vulnerability in DCE implementations provided by various vendors that may be triggered by exploits or scanning tools associated with this issue. Please see BID 8371 for further details on the availability of fixes for affected implementations. It should be noted that this is a side-effect that may cause problems with DCE implementations, but does not affect Microsoft Windows itself. Microsoft has released an update to their advisory stated that while the provided Windows 2000 patch will install on Windows 2000 SP2, it is unsupported. Microsoft recommends users to upgrade to a supported Service Pack. Further information can be found in MS03-026. Cisco has released an advisory detailing products affected by this vulnerability, as well as making fix information available. Additional details available in referenced advisory. Microsoft has released new fixes that supersede the original fixes for this issue. Administrators are advised to apply the new patches as they also address BID 8458, 8459, and 8460 in addition to this BID. HP has made fixes available for OpenVMS. Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows XP Professional
Cisco Conference Connection
Microsoft Windows NT Workstation 4.0 SP6a
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows XP Home SP1
Microsoft Windows XP 64-bit Edition
Cisco IP Contact Center Express
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Advanced Server SP2
Cisco Call Manager 1.0
Cisco Call Manager 3.0
Cisco Call Manager 3.1 (3a)
Cisco Call Manager 3.1 (2)
Cisco Call Manager 3.3 (3)
Compaq OpenVMS 6.2 VAX
Compaq OpenVMS 6.2 -1H2 Alpha
Compaq OpenVMS 7.1 VAX
Compaq OpenVMS 7.1 Alpha
Compaq OpenVMS 7.2 Alpha
Compaq OpenVMS 7.2 VAX
Compaq OpenVMS 7.2 -1H1 Alpha
Compaq OpenVMS 7.2 -1H2 Alpha
Compaq OpenVMS 7.2 -2 Alpha
Compaq OpenVMS 7.3 Alpha
Compaq OpenVMS 7.3 -1 Alpha
|
|
|
Privacy Statement |
