New public reports for vulnerability exploitation of the DNS Service in Win Server OS

Zazula · 04-13-2007, 12:46 AM

Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution.

http://www.microsoft.com/technet/sec...ry/935964.mspx

Microsoft is investigating new public reports of a limited attack exploiting a vulnerability in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. Microsoft Windows 2000 Professional Service Pack 4, Windows XP Service Pack 2, and Windows Vista are not affected as these versions do not contain the vulnerable code.

Microsoft’s initial investigation reveals that the attempts to exploit this vulnerability could allow an attacker to run code in the security context of the Domain Name System Server Service, which by default runs as Local SYSTEM.

Upon completion of this investigation, Microsoft will take appropriate action, which may include providing a security update through their monthly release process or providing an out-of-cycle security update, depending on customer needs.

Zazula · 04-14-2007, 02:23 AM

Revision Note: April 13, 2007: Advisory updated to include additional details about Windows Small Business Server. Mitigations also updated to include additional information regarding the affected network port range and firewall configuration. Additional details also provided for registry key mitigation values.

Zazula · 04-15-2007, 03:56 PM

Revision Note: April 15, 2007: Advisory "Suggested Actions" section updated to include additional information regarding TCP and UDP port 445 and the 15 character computer name known issue.

Zazula · 04-16-2007, 09:47 PM

Revision Note: April 16, 2007: Advisory updated: Ongoing monitoring indicates that we are seeing a new attack that is attempting to exploit this vulnerability. MSRA partners have indicated that latest signatures are successfully protecting against this attack.

Zazula · 05-08-2007, 10:47 PM

Critical update issued ( Microsoft Security Bulletin MS07-029) and included in the Microsoft Security Updates pack for May 2007.

04-13-2007, 12:46 AM	#1 (permalink)
Zazula Manager Emeritus, I'm blond, James Blond Join Date: Apr 2006 Location: Athens, Greece Posts: 7,667 OS: Win XP Pro SP2	New public reports for vulnerability exploitation of the DNS Service in Win Server OS Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution. http://www.microsoft.com/technet/sec...ry/935964.mspx Microsoft is investigating new public reports of a limited attack exploiting a vulnerability in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. Microsoft Windows 2000 Professional Service Pack 4, Windows XP Service Pack 2, and Windows Vista are not affected as these versions do not contain the vulnerable code. Microsoft’s initial investigation reveals that the attempts to exploit this vulnerability could allow an attacker to run code in the security context of the Domain Name System Server Service, which by default runs as Local SYSTEM. Upon completion of this investigation, Microsoft will take appropriate action, which may include providing a security update through their monthly release process or providing an out-of-cycle security update, depending on customer needs. __________________ "Time is the wisest because it discovers everything" Thales of Miletus (ca.624BC-ca.546BC) "Everything flows, nothing stands still." Heraclitus of Ephesus (ca.535BC-475BC) "One thing I know, that I know nothing" Socrates of Athens (ca.470BC–399BC)

04-14-2007, 02:23 AM	#2 (permalink)
Zazula Manager Emeritus, I'm blond, James Blond Join Date: Apr 2006 Location: Athens, Greece Posts: 7,667 OS: Win XP Pro SP2	Re: New public reports for vulnerability exploitation of the DNS Service in Win Serve Revision Note: April 13, 2007: Advisory updated to include additional details about Windows Small Business Server. Mitigations also updated to include additional information regarding the affected network port range and firewall configuration. Additional details also provided for registry key mitigation values. __________________ "Time is the wisest because it discovers everything" Thales of Miletus (ca.624BC-ca.546BC) "Everything flows, nothing stands still." Heraclitus of Ephesus (ca.535BC-475BC) "One thing I know, that I know nothing" Socrates of Athens (ca.470BC–399BC)

04-15-2007, 03:56 PM	#3 (permalink)
Zazula Manager Emeritus, I'm blond, James Blond Join Date: Apr 2006 Location: Athens, Greece Posts: 7,667 OS: Win XP Pro SP2	Re: New public reports for vulnerability exploitation of the DNS Service in Win Serve Revision Note: April 15, 2007: Advisory "Suggested Actions" section updated to include additional information regarding TCP and UDP port 445 and the 15 character computer name known issue. __________________ "Time is the wisest because it discovers everything" Thales of Miletus (ca.624BC-ca.546BC) "Everything flows, nothing stands still." Heraclitus of Ephesus (ca.535BC-475BC) "One thing I know, that I know nothing" Socrates of Athens (ca.470BC–399BC)

04-16-2007, 09:47 PM	#4 (permalink)
Zazula Manager Emeritus, I'm blond, James Blond Join Date: Apr 2006 Location: Athens, Greece Posts: 7,667 OS: Win XP Pro SP2	Re: New public reports for vulnerability exploitation of the DNS Service in Win Serve Revision Note: April 16, 2007: Advisory updated: Ongoing monitoring indicates that we are seeing a new attack that is attempting to exploit this vulnerability. MSRA partners have indicated that latest signatures are successfully protecting against this attack. __________________ "Time is the wisest because it discovers everything" Thales of Miletus (ca.624BC-ca.546BC) "Everything flows, nothing stands still." Heraclitus of Ephesus (ca.535BC-475BC) "One thing I know, that I know nothing" Socrates of Athens (ca.470BC–399BC)

05-08-2007, 10:47 PM	#5 (permalink)
Zazula Manager Emeritus, I'm blond, James Blond Join Date: Apr 2006 Location: Athens, Greece Posts: 7,667 OS: Win XP Pro SP2	Re: New public reports for vulnerability exploitation of the DNS Service in Win Serve Critical update issued ( Microsoft Security Bulletin MS07-029) and included in the Microsoft Security Updates pack for May 2007. __________________ "Time is the wisest because it discovers everything" Thales of Miletus (ca.624BC-ca.546BC) "Everything flows, nothing stands still." Heraclitus of Ephesus (ca.535BC-475BC) "One thing I know, that I know nothing" Socrates of Athens (ca.470BC–399BC)