Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Serv…

Exploit prediction (EPSS)

77.66% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

• Metasploit exploit/windows/smb/ms07_029_msdns_zonename MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB) · metasploit exploit, manual rank · 2007-04-12
• Metasploit exploit/windows/dcerpc/ms07_029_msdns_zonename MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP) · metasploit exploit, great rank · 2007-04-12
• EDB-3746 Microsoft Windows - DNS RPC Remote Buffer Overflow (2) · remote · 2007-04-18
• EDB-3740 Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow · remote · 2007-04-15
• EDB-3737 Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow · remote · 2007-04-15
• EDB-16748 Microsoft DNS RPC Service - 'extractQuotedChar()' TCP Overflow (MS07-029) (Metasploit) · remote · 2010-07-25
• EDB-16366 Microsoft DNS RPC Service - 'extractQuotedChar()' Remote Overflow 'SMB' (MS07-029) (Metasploit) · remote · 2010-09-28

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• secunia.com /advisories/24871 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• securityfocus.com /archive/1/468871/100/200/threaded · vendor-advisory, x_refsource_HP, x_transferred
• securityfocus.com /archive/1/465863/100/100/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• microsoft.com /technet/security/advisory/935964.mspx · x_refsource_CONFIRM, x_transferred
• us-cert.gov /cas/techalerts/TA07-128A.html · third-party-advisory, x_refsource_CERT, x_transferred
• securityfocus.com /bid/23470 · vdb-entry, x_refsource_BID, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/33629 · vdb-entry, x_refsource_XF, x_transferred
• blogs.technet.com /msrc/archive/2007/04/12/microsoft-security-advisory-935964-posted.aspx · x_refsource_MISC, x_transferred
• securitytracker.com /id?1017910 · vdb-entry, x_refsource_SECTRACK, x_transferred
• metasploit.com /svn/framework3/trunk/modules/exploits/windows/dcerpc/msdns_zonename.rb · x_refsource_MISC, x_transferred
• vupen.com /english/advisories/2007/1366 · vdb-entry, x_refsource_VUPEN, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1228 · vdb-entry, signature, x_refsource_OVAL, x_transferred
• us-cert.gov /cas/techalerts/TA07-103A.html · third-party-advisory, x_refsource_CERT, x_transferred
• kb.cert.org /vuls/id/555920 · third-party-advisory, x_refsource_CERT-VN, x_transferred
• docs.microsoft.com /en-us/security-updates/securitybulletins/2007/ms07-029 · vendor-advisory, x_refsource_MS, x_transferred

Sources

• CVE List: CVE-2007-1748
• NVD: CVE-2007-1748

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.