Rule:--Sid:2311--Summary:This event is generated when an attempt is made to exploit a knownvulnerability in the Microsoft Windows Workstation service.--Impact:Serious. Denial of Service (DoS), execution of arbitrary code ispossible.--Detailed Information:Due to insufficient bounds checking in the Microsoft Windows Workstationservice, it may be possible for an attacker to overwrite portions ofmemory. This can result in the attacker being presented with theopportunity to execute code of their choosing. Under some circumstancesa Denial of Service condition may be possible against the target host.Specifically, the DCE/RPC service allows for overly long strings to besent to the Workstation logging function. This logging function does notcheck parameters sufficiently which results in the buffer overflowcondition.--Affected Systems:	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4	Microsoft Windows XP, Microsoft Windows XP Service Pack 1	Microsoft Windows XP 64-Bit Edition--Attack Scenarios:The attacker may use one of the available exploits to target avulnerable host.--Ease of Attack:Simple. Exploit code exists.--False Positives:None known.--False Negatives:None known--Corrective Action:Apply the appropriate vendor supplied patches and service packs.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:CERT:http://www.cert.org/advisories/CA-2003-28.htmlhttp://www.kb.cert.org/vuls/id/567620Microsoft:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp--