Rule:--Sid:3967--Summary:This event is generated when an attempt is made to exploit a knownvulnerability is the Microsoft Plug and Play subsystem on a host.--Impact:Serious. Execution of code is possible leading to full systemcompromise.--Detailed Information:A programming error in the Plug and Play (PnP) service used byMicrosoft Windows machines can present a remote attacker with theopportunity to overflow a fixed length buffer, execute code on thevulnerable system and escalate privileges on the host to the extentthat they could take complete control of the affected machine.Specifically this event is generated when the PNP_QueryResConfListoperation is targeted via the dcerpc_request function.--Affected Systems:  Microsoft Windows 2000  Microsoft Windows XP  Microsoft Windows 2003--Attack Scenarios:An attacker merely needs to send extra data to the PnP service tooverflow the buffer and execute code of their choosing on the affectedsystem.--Ease of Attack:Simple. Exploit code is freely available. A worm is known to exist thatexploits this vulnerability.--False Positives:None known.--False Negatives:None known.--Corrective Action:Apply the appropriate vendor supplied patches.Disallow access to ports 139 and 445 from sources external to theprotected network.Consider disabling the use of those ports completely on Windows basednetworks.--Contributors:Sourcefire Vulnerability Research TeamMatt Watchinski <matthew.watchinski@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Microsoft:http://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/rbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/Zotob--