Description
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 10
- Microsoft Windows XP/2000 - RPC Remote Non Exec Memory EDB-117 · remote · Nov 7, 2003 · verified
- Microsoft Windows - 'RPC2' Universal / Denial of Service (RPC3) (MS03-039) EDB-109 · remote · Oct 9, 2003 · verified
- Microsoft Windows - 'RPC DCOM2' Remote (MS03-039) EDB-103 · remote · Sep 20, 2003 · verified
- Microsoft Windows - 'RPC DCOM' Scanner (MS03-039) EDB-97 · remote · Sep 12, 2003 · verified
- Microsoft Windows - 'RPC DCOM' Remote (Universal) EDB-76 · remote · Aug 7, 2003 · verified
- Microsoft Windows - 'RPC DCOM' Remote (2) EDB-70 · remote · Jul 30, 2003 · verified
- Microsoft Windows - 'RPC DCOM' Remote (1) EDB-69 · remote · Jul 29, 2003 · verified
- Microsoft Windows XP/2000 - 'RPC DCOM' Remote (MS03-026) EDB-66 · remote · Jul 26, 2003 · verified
- Microsoft Windows - 'RPC DCOM' Remote Buffer Overflow EDB-64 · remote · Jul 25, 2003 · verified
- Microsoft Windows Server 2000 - RPC DCOM Interface Denial of Service EDB-61 · dos · Jul 21, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20030720 Microsoft Windows 2000 RPC DCOM Interface DOS AND Privilege Escalation Vulnerability mailing-list
- 20030721 Microsoft Windows 2000 RPC DCOM Interface DOS AND Privilege Escalation Vulnerability mailing-list
- CA-2003-23 third-party-advisory
- oval:org.mitre.oval:def:494 vdb-entry signature
- oval:org.mitre.oval:def:1118 vdb-entry signature
- CA-2003-19 third-party-advisory
- VU#326746 third-party-advisory
- MS03-039 vendor-advisory