Executive Summary

Informations
Name CVE-2005-2119 First vendor Publication 2005-10-12
Vendor Cve Last vendor Modification 2018-10-12

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2119

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1071
 
Oval ID: oval:org.mitre.oval:def:1071
Title: MSDTC Unchecked Buffer Permits Remote Code Execution or Privilege Elevation (WinXP,SP1)
Description: The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Family: windows Class: vulnerability
Reference(s): CVE-2005-2119
 Version: 4
Platform(s): Microsoft Windows XP
 Product(s): MSDTC
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1452
 
Oval ID: oval:org.mitre.oval:def:1452
Title: MSDTC Unchecked Buffer Permits Remote Code Execution or Privilege Elevation (Server 2003)
Description: The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Family: windows Class: vulnerability
Reference(s): CVE-2005-2119
 Version: 5
Platform(s): Microsoft Windows Server 2003
 Product(s): MSDTC
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:551
 
Oval ID: oval:org.mitre.oval:def:551
Title: MSDTC Unchecked Buffer Permits Remote Code Execution or Privilege Elevation (Win2k,SP4)
Description: The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Family: windows Class: vulnerability
Reference(s): CVE-2005-2119
 Version: 5
Platform(s): Microsoft Windows 2000
 Product(s): MSDTC
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 1
Os 5
Os 3

ExploitDB Exploits

id Description
2005-10-11 Microsoft Windows 2000/2003/XP MSDTC TIP Denial Of Service Vulnerability

OpenVAS Exploits

Date Description
2009-11-16 Name : Microsoft RPC Interface Buffer Overrun (KB824146)
File : nvt/msrpc_dcom2.nasl
2005-11-03 Name : Microsoft RPC Interface Buffer Overrun (823980)
File : nvt/msrpc_dcom.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
18828 Microsoft Windows Distributed Transaction Coordinator (DTC) Memory Modificati...

Microsoft Windows contains a flaw that may allow a remote attacker to gain privileges. The issue is due to the MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocating a 4K page of memory regardless of the required size, which allows an attacker to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.

Snort® IPS/IDS

Date Description
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian object call overflow attempt
RuleID : 6418 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW object call overflow attempt
RuleID : 6417 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW object call overflow attempt
RuleID : 6416 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian object call overflow attempt
RuleID : 6415 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW little endian overflow attempt
RuleID : 4252 - Revision : 9 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian overflow attempt
RuleID : 4251 - Revision : 9 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW overflow attempt
RuleID : 4250 - Revision : 9 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW little endian overflow attempt
RuleID : 4249 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW overflow attempt
RuleID : 4248 - Revision : 9 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW overflow attempt
RuleID : 4247 - Revision : 6 - Type : NETBIOS
2014-01-10 DCERPC NCADG-IP-UDP msdtc BuildContextW overflow attempt
RuleID : 4246 - Revision : 14 - Type : OS-WINDOWS
2014-01-10 DCERPC NCACN-IP-TCP msdtc BuildContextW overflow attempt
RuleID : 4245 - Revision : 14 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date Description
2005-10-12 Name : A vulnerability in MSDTC could allow remote code execution.
File : smb_kb902400.nasl - Type : ACT_GATHER_INFO
2005-10-11 Name : A vulnerability in MSDTC and COM+ could allow remote code execution.
File : smb_nt_ms05-051.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/15056
CERT http://www.us-cert.gov/cas/techalerts/TA05-284A.html
CERT-VN http://www.kb.cert.org/vuls/id/180868
CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
EEYE http://www.eeye.com/html/research/advisories/AD20051011b.html
MS https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05...
OSVDB http://www.osvdb.org/18828
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECTRACK http://securitytracker.com/id?1015037
SECUNIA http://secunia.com/advisories/17161
http://secunia.com/advisories/17172
http://secunia.com/advisories/17223
http://secunia.com/advisories/17509
SREASON http://securityreason.com/securityalert/73

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
Date Informations
2021-05-04 12:03:02
  • Multiple Updates
2021-04-22 01:03:19
  • Multiple Updates
2020-05-23 00:16:40
  • Multiple Updates
2018-10-13 00:22:32
  • Multiple Updates
2018-05-03 09:19:26
  • Multiple Updates
2016-06-28 15:19:45
  • Multiple Updates
2016-04-26 13:38:21
  • Multiple Updates
2014-02-17 10:32:00
  • Multiple Updates
2014-01-19 21:22:48
  • Multiple Updates
2013-05-11 11:28:16
  • Multiple Updates