PT-2007-4331 · Microsoft · Message Queuing (Msmq) Service+4

Axis + 1 · Publicado 2007-12-11 · Atualizado 2018-10-16 · CVE-2007-3039

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Windows XP SP3 Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4 Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Professional SP4 Microsoft Message Queuing (MSMQ) service in Microsoft Windows XP SP2

Description: A stack-based buffer overflow issue exists in the Microsoft Message Queuing (MSMQ) service, allowing attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103. This issue is remotely exploitable on Windows 2000 Server. The vulnerability occurs when the Message Queuing Service incorrectly validates input strings before passing them to a buffer. An attacker could exploit this by constructing a specially crafted MSMQ message, potentially allowing remote code execution on Microsoft Windows 2000 and local elevation of privilege on Windows XP.

Recommendations: For Microsoft Windows 2000 Server SP4, consider disabling the MSMQ service until a patch is available. For Microsoft Windows 2000 Professional SP4, restrict access to the MSMQ service to minimize the risk of exploitation. For Microsoft Windows XP SP2, avoid using the MSMQ service in a local scenario until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-3039

Produtos afetados

Message Queuing (Msmq) Service

Windows

Windows 2000 Professional

Windows 2000 Server

Windows Xp

Referências · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/ms07_065_msmq.rb · Exploit
• 🔥 https://exploit-db.com/exploits/4745 · Exploit
• 🔥 https://exploit-db.com/exploits/16750 · Exploit
• 🔥 https://exploit-db.com/exploits/4934 · Exploit
• 🔥 https://exploit-db.com/exploits/4760 · Exploit
• http://securityfocus.com/archive/1/485268/100/0/threaded · Aviso do Fabricante
• http://secunia.com/advisories/28051 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-07-076.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3039 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3039 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-065 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-065 · Nota
• http://us-cert.gov/cas/techalerts/TA07-345A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4474 · Nota
• http://vupen.com/english/advisories/2007/4181 · Nota