Microsoft windows server service vulnerability 958644

If an exploit attempt fails, this could also lead to a crash in Svchost. If the crash in Svchost. The Server service provides file, print, and named pipe sharing over the network. The vulnerability is caused by the Server service, which does not correctly handle specially crafted RPC requests. The English United States version of this software update installs files that have the attributes that are listed in the following tables.

The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time DST bias.

Additionally, the dates and times may change when you perform certain operations on the files. For all supported editions of Microsoft Windows Service Pack 4. GDR service branches contain only those fixes that are widely released to address widespread, critical issues.

QFE service branches contain hotfixes in addition to widely released fixes. In addition to the files that are listed in these tables, this software update also installs an associated security catalog file KB number.

Service Pack 1 is integrated into the original release version of Windows Server RTM milestone files have a 6. Summary: This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request.

On Microsoft Windows , Windows XP, and Windows Server systems, an attacker could exploit this vulnerability without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit.

Firewall best practices and standard default firewall configurations can help protect network resources from attacks that originate outside the enterprise perimeter. Common Vulnerability Enumeration. Common Weakness Enumeration. Oval Markup Language. Common Plateform Enumeration. Open Source Vulnerability Database. Where filterKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx equates to the randomly generated UUID relevant to your system. Impact of workaround. These ports are used to initiate a connection with the affected component.

Blocking TCP ports and at the firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. Microsoft recommends that you block all unsolicited inbound communication from the Internet to help prevent attacks that may use other ports.

Several Windows services use the affected ports. Blocking connectivity to the ports may cause various applications or services to not function. To help protect from network-based attempts to exploit this vulnerability, use a personal firewall, such as the Internet Connection Firewall.

All supported editions of Windows Vista come with Windows Firewall, a two-way firewall that is automatically enabled. For all supported editions of Windows XP and Windows Server , use the Internet Connection Firewall feature to help protect your Internet connection by blocking unsolicited incoming traffic.

Microsoft recommends that you block all unsolicited incoming communication from the Internet. By default, the Windows Firewall feature in Windows XP helps protect your Internet connection by blocking unsolicited incoming traffic. We recommend that you block all unsolicited incoming communication from the Internet. On the General tab, ensure that the On recommended value is selected. This will enable the Windows Firewall. For Windows Server systems, configure Internet Connection Firewall manually for a connection using the following steps:.

Right-click the connection on which you want to enable Internet Connection Firewall, and then click Properties. Click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box, and then click OK.

Note If you want to enable certain programs and services to communicate through the firewall, click Settings on the Advanced tab, and then select the programs, the protocols, and the services that are required. What is the scope of the vulnerability?

This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. If successfully exploited, an attacker could then install programs or view, change, or delete data; or create new accounts with full user rights. What causes the vulnerability? The vulnerability is caused by the Windows Server service not properly handling specially crafted RPC requests.

What is the Server service? The Server service provides RPC support, file and print support, and named pipe sharing over the network.

The Server service allows the sharing of your local resources such as disks and printers so that other users on the network can access them. There are no updates available for other versions of the operating systems listed for example, RTM or different service pack levels or for older operating systems. Customers should update to the latest service pack version to receive security updates. To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release.

Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems.

To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program MAPP Partners.

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.

Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode.

Please rate your experience Yes No. Any additional feedback? In this article. Do not know which Windows version you are running? See [Which Windows operating system am I running? The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft, Windows XP and Windows Server systems, an attacker could exploit this vulnerability without authentication to run arbitrary code.