Microsoft Systems Management Server Remote Denial Of Service Vulnerability

Bugtraq ID:	10726
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 14 2004 12:00AM
Updated:	Jul 14 2004 12:00AM
Credit:	This issue was disclosed by HexView.
Vulnerable:	Microsoft Systems Management Server 2.50.2726 .0 Microsoft Systems Management Server 2.0 SP1 Microsoft Systems Management Server 2.0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows NT 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 Microsoft Systems Management Server 1.2 SP4 Microsoft Systems Management Server 1.2 SP3 Microsoft Systems Management Server 1.2 SP2 Microsoft Systems Management Server 1.2 SP1 Microsoft Systems Management Server 1.2 - Hancom Hancom Office 2007 0 - Hancom Hancom Office 2007 0 - Microsoft Windows NT 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

Microsoft Systems Management Server Remote Denial Of Service Vulnerability

Reportedly Microsoft Systems Management Server is vulnerable to a remote denial of service vulnerability. This issue is due to a failure of the affected server to handle exceptional conditions.

Successful exploitation of this issue will allow an attacker to trigger a denial of service condition in the affected server. Code execution might be possible but is unlikely and unconfirmed.

Microsoft Systems Management Server Remote Denial Of Service Vulnerability

No exploit is required to leverage this issue. The following string sent to the affected server over tcp port 2702 is reported to trigger this issue:

Sending the string "RCH0####RCHE" followed by more than 130 characters will trigger this issue.

Proof of concept (sms_dos.pl) was supplied by MacDefender and SRR project group.

• /data/vulnerabilities/exploits/sms_dos.pl

Microsoft Systems Management Server Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Systems Management Server Remote Denial Of Service Vulnerability

References:

• [HV-MED] DoS in Microsoft SMS Client ([email protected])
  
• MS SMS DOS Proof-of-concept code and Snort sig ()