Ph4nt0m Security Team

[News]Windows DNS RPC Remote Code Execution Vulnerability

By ph4nt0m. Saturday, 14. April 2007, 16:57:00

by axis
Date: 2007-04-15

流传了一段时间的一个0day，今天微软终于报出来了。

http://www.microsoft.com/technet/security/advisory/935964.mspx

FrSIRT的公告

A vulnerability has been identified in Microsoft Windows, 
which could be exploited by remote attackers to take complete control of an affected system. 
This issue is caused by a stack overflow error in the Windows Domain Name System (DNS) Server's RPC interface implementation 
when processing malformed requests, which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges 
by sending a specially crafted request to a vulnerable system.

Note : This vulnerability is currently being exploited in the wild.

Metasploit 已经出了一个POC，还会再继续完善。
dnspoc