Malicious code execution on Microsoft Windows DNS Server
A vulnerability in Microsoft's DNS Server Service allows attackers, under certain circumstances, to remotely gain full control of affected systems. According to an advisory published by Microsoft, certain manipulated RPC packets cause a buffer overrun in the DNS service, which may be used to infiltrate malicious code, which is then executed by the service with SYSTEM privileges. According to Microsoft, this hole is already being actively exploited and no patch has been provided yet to fix this bug .
The Microsoft DNS Server is a component of Windows 2000 SP 4 and Windows Server 2003 with SP1 and SP2 and is not enabled by default. Microsoft advises users to disable RPC remote management for the DNS Server Service on vulnerable systems. To achieve this, users must create a DWORD type registry entry with the name RpcProtocol and the value 4 under HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters. Microsoft also recommends restricting network access for RPC packets to TCP ports in the range 1024 to 5000 to trusted IP addresses.
See also:
- Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution (935964), Microsoft advisory
(mba)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
