The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A551
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1452
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1071
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-051
http://www.us-cert.gov/cas/techalerts/TA05-284A.html
http://www.securityfocus.com/bid/15056
http://www.kb.cert.org/vuls/id/180868
http://www.eeye.com/html/research/advisories/AD20051011b.html
http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
http://securitytracker.com/id?1015037
http://securityreason.com/securityalert/73
http://secunia.com/advisories/17509
http://secunia.com/advisories/17223