Description
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Windows 2000 Professional SP4, and Windows XP SP2 allows attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103. NOTE: this is remotely exploitable on Windows 2000 Server.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow
exploit/windows/dcerpc/ms07_065_msmq
Exploit-DB 4
- Microsoft Message Queueing Service - DNS Name Path Overflow (MS07-065) (Metasploit) EDB-16750 · remote · Jul 25, 2010 · verified
- Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (2) EDB-4934 · remote · Jan 18, 2008 · verified
- Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065) EDB-4760 · remote · Dec 21, 2007 · verified
- Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (1) EDB-4745 · remote · Dec 18, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 4934 exploit
- 4760 exploit
- 4745 exploit
- oval:org.mitre.oval:def:4474 vdb-entry signature
- SSRT071506 vendor-advisory
- 1019077 vdb-entry
- 28011 third-party-advisory
- 26797 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-076.html
- TA07-345A third-party-advisory
- MS07-065 vendor-advisory
- ADV-2007-4181 vdb-entry
- 20071211 ZDI-07-076: Microsoft Windows Message Queuing Service Stack Overflow Vulnerability mailing-list
- 28051 third-party-advisory