Rule:--Sid:5002--Summary:This event is generated when an attempt is made to exploit a buffer overrun condition in Microsoft products via the Local Security Authority Subsystem Service (LSASS).--Impact:Remote execution of arbitrary code.--Detailed Information:A vulnerability exists in LSASS that may present an attacker with the opportunity to execute code of their choosing on an affected host.The problem lies in an unchecked buffer in the LSASS service, suscessful exploitation may present the attacker with the opportunity to gain control of the affected system.--Affected Systems:Microsoft Windows 2000, 2003 and XP systems.--Attack Scenarios:An attcker needs to make a specially crafted request to the LSASS service that could contain harmful code to gain further access to the system.--Ease of Attack:Moderate.--False Positives:None known.--False Negatives:None known.--Corrective Action:Apply the appropriate vendor supplied patchesUse a packet filtering firewall to deny access to TCP and UDP ports 135 and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources outside the protected network.Access should also be denied to ephemeral ports and any other ports used by RPC services from sources external to the protected network.--Contributors:Sourcefire Vulnerability Research TeamMatt Watchinski <mwatchinski@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Microsoft:http://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Gaobothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Sasserhttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Korgohttp://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/rbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Sdbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Mytobhttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Spybothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Wootbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/Bobax--