A recently discovered vulnerability in the Remote Procedure Call (RPC) subsystem in Windows NT, 2000, and XP threatens to provide hackers with a means to perform Denial of Service (DoS) attacks, Microsoft said yesterday.
And while the company has already created a patch for Win2K and XP users, Microsoft says that major changes in RPC since the release of NT 4.0 prevent it from creating a patch for that OS. Instead, NT 4.0 users can use a workaround, described on the Microsoft Web site.
The RPC service allows applications on a local computer to call functions in applications residing on a remote computer in a network. Taking advantage of a vulnerability in this service, it's possible to create an application that can send malformed requests to RPC, Microsoft notes in its advisory, causing the RPC service to fail.
This week's RPC vulnerability follows a serious Windows 2000 flaw announced a week earlier involving ntdll.dll, one of the core system library files in that system. According to the CERT Coordination Center, this library file has a buffer overflow vulnerability that is being actively exploited on WebDAV-enabled IIS 5.0 servers, which could allow remote attackers to execute arbitrary code on unpatched systems. The organization recommends that sites running Win2K apply a patch or disable the WebDAV services as soon as possible. The patch download URL is available below.
Patch for ntdll.dll Vulnerability
Microsoft Security Bulletin - RPC Vulnerability
NT 4.0 Workaround to RPC Vulnerability