Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.

It was possible to log into the remote host with the login 'e' and the password 'asd#321'.
A widely available exploit, using one of the vulnerabilities described in the Microsoft Bulletin MS03-039 creates such an account. This probably means that the remote host has been compromised by the use of this exploit.

The remote host is running a version of Windows that has a flaw in its RPC interface, which may allow an attacker to execute arbitrary code and gain SYSTEM privileges.

An attacker or a worm could use it to gain the control of this host.

Note that this is NOT the same bug as the one described in MS03-026, which fixes the flaw exploited by the 'MSBlast' (or LoveSan) worm.

The remote host is running a version of Windows affected by several vulnerabilities in its RPC interface and RPCSS Service, that could allow an attacker to execute arbitrary code and gain SYSTEM privileges.

ID	Name	Product	Family	Severity
11839	MS03-039 Exploitation Backdoor Account Detection	Nessus	Backdoors	critical
11835	MS03-039: Microsoft RPC Interface Buffer Overrun (824146) (uncredentialed check)	Nessus	Windows	critical
11790	MS03-026 / MS03-039: Buffer Overrun In RPCSS Service Could Allow Code Execution (823980 / 824146)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2003-0528

critical

Tenable Plugins

critical

critical

critical