Executive Summary

Informations
Name MS06-018 First vendor Publication N/A
Vendor Microsoft Last vendor Modification N/A
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability in Microsoft Distributed Transaction Coordinator Could Allow Denial of Service (913580)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1222
 
Oval ID: oval:org.mitre.oval:def:1222
Title: MSDTC Invalid Memory Access Vulnerability (Win2K)
Description: Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
Family: windows Class: vulnerability
Reference(s): CVE-2006-0034
Version: 6
Platform(s): Microsoft Windows 2000
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1295
 
Oval ID: oval:org.mitre.oval:def:1295
Title: MSDTC Denial of Service Vulnerability (XP,SP1)
Description: Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
Family: windows Class: vulnerability
Reference(s): CVE-2006-1184
Version: 6
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1477
 
Oval ID: oval:org.mitre.oval:def:1477
Title: MSDTC Invalid Memory Access Vulnerability (Server 2003)
Description: Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
Family: windows Class: vulnerability
Reference(s): CVE-2006-0034
Version: 6
Platform(s): Microsoft Windows Server 2003
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1779
 
Oval ID: oval:org.mitre.oval:def:1779
Title: MSDTC Denial of Service Vulnerability (Server 2003)
Description: Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
Family: windows Class: vulnerability
Reference(s): CVE-2006-1184
Version: 7
Platform(s): Microsoft Windows Server 2003
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1908
 
Oval ID: oval:org.mitre.oval:def:1908
Title: MSDTC Invalid Memory Access Vulnerability (XP,SP1)
Description: Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
Family: windows Class: vulnerability
Reference(s): CVE-2006-0034
Version: 5
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1912
 
Oval ID: oval:org.mitre.oval:def:1912
Title: MSDTC Denial of Service Vulnerability (XP,SP2)
Description: Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
Family: windows Class: vulnerability
Reference(s): CVE-2006-1184
Version: 7
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1990
 
Oval ID: oval:org.mitre.oval:def:1990
Title: MSDTC Denial of Service Vulnerability (Win2K)
Description: Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
Family: windows Class: vulnerability
Reference(s): CVE-2006-1184
Version: 7
Platform(s): Microsoft Windows 2000
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 5
Os 6
Os 40
Os 10

OpenVAS Exploits

Date Description
2009-11-16 Name : Microsoft RPC Interface Buffer Overrun (KB824146)
File : nvt/msrpc_dcom2.nasl
2005-11-03 Name : Microsoft RPC Interface Buffer Overrun (823980)
File : nvt/msrpc_dcom.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
25336 Microsoft Windows Distributed Transaction Coordinator (DTC) BuildContextW Req...

Microsoft Windows contains a flaw that may allow a remote denial of service. The issue is triggered when the Distributed Transaction Coordinator receives a single BuildContextW request where the 'UuidString' or 'GuidIn' value has a maximum character count of 0x7D0, and will result in loss of availability for the service.
25335 Microsoft Windows Distributed Transaction Coordinator (DTC) CRpcIoManagerServ...

Windows Systems for which the MS05-051 patch was not released ( NT4 and W2K SP2&3 ) were found to be vulnerable to a remotely exploitable SYSTEM level compromise through the same DTC RPC Service as previously described. This is accomplished via a complex heap overflow through the 5th argument to BuildContext or BuildContextW, depending upon the O/S version. This is enabled by default and thus classed as critical.

Snort® IPS/IDS

Date Description
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContext little endian object call heap overflow ...
RuleID : 6466 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContext object call heap overflow attempt
RuleID : 6465 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContext little endian object call heap overflow attempt
RuleID : 6464 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContext object call heap overflow attempt
RuleID : 6463 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContext little endian heap overflow attempt
RuleID : 6462 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContext heap overflow attempt
RuleID : 6461 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContext heap overflow attempt
RuleID : 6460 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContext little endian heap overflow attempt
RuleID : 6459 - Revision : 6 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContext little endian heap overflow attempt
RuleID : 6458 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContext little endian heap overflow attempt
RuleID : 6457 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC NCADG-IP-UDP msdtc BuildContext heap overflow attempt
RuleID : 6456 - Revision : 12 - Type : OS-WINDOWS
2014-01-10 DCERPC NCACN-IP-TCP msdtc BuildContext heap overflow attempt
RuleID : 6455 - Revision : 12 - Type : OS-WINDOWS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW object call heap overflow attempt
RuleID : 6454 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian object call heap overflow att...
RuleID : 6453 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian object call heap overflow...
RuleID : 6452 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW object call heap overflow attempt
RuleID : 6451 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW heap overflow attempt
RuleID : 6450 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW heap overflow attempt
RuleID : 6449 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian heap overflow attempt
RuleID : 6448 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW heap overflow attempt
RuleID : 6447 - Revision : 5 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW little endian heap overflow attempt
RuleID : 6446 - Revision : 6 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW little endian heap overflow attempt
RuleID : 6445 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC NCADG-IP-UDP msdtc BuildContextW heap overflow attempt
RuleID : 6444 - Revision : 13 - Type : OS-WINDOWS
2014-01-10 DCERPC NCACN-IP-TCP msdtc BuildContextW heap overflow attempt
RuleID : 6443 - Revision : 14 - Type : OS-WINDOWS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW object call invalid second uuid size at...
RuleID : 6442 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian object call invalid secon...
RuleID : 6441 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian object call invalid second uu...
RuleID : 6440 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW object call invalid second uuid size attempt
RuleID : 6439 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW invalid second uuid size attempt
RuleID : 6438 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW little endian invalid second uuid si...
RuleID : 6437 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW invalid second uuid size attempt
RuleID : 6436 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian invalid second uuid size ...
RuleID : 6435 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian invalid second uuid size attempt
RuleID : 6434 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW little endian invalid second uuid size a...
RuleID : 6433 - Revision : 6 - Type : NETBIOS
2014-01-10 DCERPC NCADG-IP-UDP msdtc BuildContextW invalid second uuid size attempt
RuleID : 6432 - Revision : 15 - Type : OS-WINDOWS
2014-01-10 DCERPC NCACN-IP-TCP msdtc BuildContextW heap overflow attempt
RuleID : 6431 - Revision : 17 - Type : OS-WINDOWS
2014-01-10 DCERPC DIRECT msdtc BuildContextW object call invalid uuid size attempt
RuleID : 6430 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW object call invalid uuid size attempt
RuleID : 6429 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian object call invalid uuid ...
RuleID : 6428 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian object call invalid uuid size...
RuleID : 6427 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW invalid uuid size attempt
RuleID : 6426 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW invalid uuid size attempt
RuleID : 6425 - Revision : 7 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP v4 msdtc BuildContextW invalid uuid size attempt
RuleID : 6424 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT-UDP msdtc BuildContextW little endian invalid uuid size attempt
RuleID : 6423 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC DIRECT v4 msdtc BuildContextW invalid uuid size attempt
RuleID : 6422 - Revision : 6 - Type : NETBIOS
2014-01-10 DCERPC DIRECT msdtc BuildContextW little endian invalid uuid size attempt
RuleID : 6421 - Revision : 8 - Type : NETBIOS
2014-01-10 DCERPC NCADG-IP-UDP msdtc BuildContextW invalid uuid size attempt
RuleID : 6420 - Revision : 16 - Type : OS-WINDOWS
2014-01-10 DCERPC NCACN-IP-TCP msdtc BuildContextW invalid uuid size attempt
RuleID : 6419 - Revision : 16 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date Description
2006-05-10 Name : A vulnerability in MSDTC could allow remote code execution.
File : smb_kb913580.nasl - Type : ACT_GATHER_INFO
2006-05-09 Name : It is possible to crash the remote MSDTC service.
File : smb_nt_ms06-018.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:45:21
  • Multiple Updates
2014-01-19 21:29:58
  • Multiple Updates