Technical description:
A core service running on all Windows 2000 domain controllers (but
not
on any other machines) contains a memory leak, which can be triggered
when it attempts to process a certain type of invalid service
request.
By repeatedly sending such a request, an attacker could deplete the
available memory on the server. If memory were sufficiently depleted,
the
domain controller could become unresponsive, which would prevent it
from
processing logon requests or issuing new Kerberos tickets. An
affected
machine could be put back into service by rebooting.
- Mitigating factors:
- Users who were already logged on and using previously issued Kerberos tickets would not be affected by domain controller unavailability.
- If there were multiple domain controllers on the domain, the unaffected machines could pick up the other machine’s load.
- If normal security practices have been followed, Internet users would be prevented by firewalls and other measures from levying requests directly to domain controllers.
You can check out all of the Microsoft Security Bulletins located on our Microsoft Security Bulletin Summary List Page.
|