PT-2006-2201 · Microsoft · Distributed Transaction Coordinator+5
Kai Zhang
·
Publicado
2006-05-09
·
Atualizado
2019-04-30
·
CVE-2006-1184
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003
Description
A denial of service issue exists, allowing remote attackers to cause a system crash via a BuildContextW request with a large
UuidString or GuidIn of a certain length, resulting in an out-of-range memory access. This could enable an attacker to send a specially crafted network message to an affected system, causing the Microsoft Distributed Transaction Coordinator (MSDTC) to stop responding. The denial of service issue does not allow an attacker to execute code or elevate their user rights but could cause the affected system to stop accepting requests.Recommendations
For Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003, consider restricting access to the BuildContextW request until a patch is available.
As a temporary workaround, consider disabling the MSDTC service to minimize the risk of exploitation.
Avoid using the
UuidString and GuidIn parameters in the BuildContextW request until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Distributed Transaction Coordinator
Windows
Windows 2000
Windows Nt 4.0
Windows Server 2003
Windows Xp