Description
The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Microsoft Windows - DTC Remote (MS05-051) (2) EDB-1352 · remote · Dec 1, 2005 · verified
- Microsoft Windows - MSDTC Service Remote Memory Modification (PoC) (MS05-051) EDB-1341 · dos · Nov 27, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 17161 third-party-advisory
- MS05-051 vendor-advisory
- 1015037 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
- oval:org.mitre.oval:def:1452 vdb-entry signature
- VU#180868 third-party-advisory
- oval:org.mitre.oval:def:1071 vdb-entry signature
- 17223 third-party-advisory
- oval:org.mitre.oval:def:551 vdb-entry signature
- 73 third-party-advisory
- 18828 vdb-entry
- 17172 third-party-advisory
- 15056 vdb-entry
- 17509 third-party-advisory
- AD20051011b third-party-advisory
- TA05-284A third-party-advisory