Rule:--Sid:8322--Summary:This event is generated when an attempt is made to exploit a known vulnerability in the Microsoft Web Client Service.--Impact:Serious. Possible execution of arbitrary code of the attackers choosing.--Detailed Information:The Microsoft Web Client Service allows applications to access resources via a network using WebDAV.A buffer overflow condition exists in the Microsoft Web Client service which may allow a remote attacker to execute code of their choosing on an affected system. The flaw can be exploited by an authenticated or guest user via RPC.--Affected Systems:Microsoft Windows XP SP2 and priorMicrosoft Windows 2003 SP1 and prior--Attack Scenarios:An attacker can supply a malformed request to the client service to trigger the exploit conditions and then run code of their choosing on an affected host. --Ease of Attack:Simple. Exploits exist.--False Positives:None known.--False Negatives:None known.--Corrective Action:Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--