TippingPoint Digital Vaccine Laboratories
DID YOU KNOW... In December of 2007, Microsoft released seven security bulletins which fixed 11 new security vulnerabilities. TippingPoint and ZDI were credited with discovering a total of four of those vulnerabilities.

Microsoft Windows 2000 Message Queuing Service Memory Corruption Vulnerability

TPTI-08-07: October 14th, 2008


Affected Vendors

Affected Products

    Windows 2000 SP4

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 6482. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows 2000 running the Message Queuing service (mqsvc.exe). User interaction is not required to exploit this vulnerability.

The specific flaw exists in the parsing of an RPC request to the Message Queing Service (mqsvc.exe). By sending a specially crafted RPC request a heap calculation can be controlled and later overflowed during an unchecked string copy operation. By sending a similar request, memory can be disclosed to the attacker. Exploitation of the heap overflow may lead to code execution under the context of the SYSTEM user.

Vendor Response

Microsoft has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2007-11-14 - Vulnerability reported to vendor
    2008-10-14 - Coordinated public release of advisory


This vulnerability was discovered by: