Software Engineering Institute

The Microsoft Windows DNS service uses RPC to facilitate remote management. The Microsoft Windows DNS service RPC management interface contains a stack-based buffer overflow. This vulnerability can be triggered by sending a specially crafted RPC packet to the RPC management interface. The management interface typically operates on a dynamically-assigned port between 1024/tcp and 5000/tcp.

This vulnerability can also be exploited via the ports used by SMB services (139/tcp, 139/udp, 445/tcp, and 445/udp). However, this attack vector requires valid authentication credentials.

More information on this vulnerability, including a list of affected products is available in Microsoft Security Bulletin MS07-029.

Exploit code for this vulnerability is publicly available, and it is being actively exploited.

A remote attacker may be able to execute arbitrary code with SYSTEM privileges.

Apply an update
This vulnerability is addressed by the updates included with Microsoft Security Bulletin MS07-029.

Until an update can be applied, the following workarounds may reduce the chances of exploitation. It is important to understand your network's configuration and service requirements before deciding what changes are appropriate. For instance, disabling the RPC interface of the DNS service may prevent administrators from being able to remotely manage a Microsoft Windows DNS server. Consider this when implementing the following workarounds:

Disable the RPC interface used by the Microsoft Windows DNS service

This workaround will configure the DNS management service to to function only via Local Procedure Call (LPC). This prevents exploitation of the vulnerability, however it also disables remote management via RPC, which is used by the Microsoft Management Console (MMC) DNS snap-in.

According to Microsoft SecurityBulletin MS07-029, the RPC remote management can be disabled by taking the following steps:

1. On the start menu click 'Run' and then type 'Regedit' and then press enter.
2. Navigate to the following registry location: “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters”.
3. On the 'Edit' menu select 'New' and then click 'DWORD Value'.
4. Where 'New Value #1' is highlighted type 'RpcProtocol' for the name of the value and then press enter.
5. Double click on the newly created value and change the value's data to 4.

All unsolicited traffic on the ports listed above should be blocked.