Rule:--Sid:3609--Summary:This rule generates an event when an attempt is made to exploit a knownvulnerability in the Microsoft Message Queuing (MSMQ) system.--Impact:Execution of arbitrary code leading to full administrator access of the machine. Denial of Service (DoS).--Detailed Information:Microsoft Message Queuing (MSMQ) enables messages to be queued fordelivery at opportune times. Applications can query the message queue asthey come online or at scheduled times.A programming error in the MSMQ subsystem may present an attacker withthe opportunity to overflow a fixed length buffer and execute code oftheir choosing on an affected host.--Affected Systems:	Windows 98 and 98SE	Windows 2000 sp 3 and sp 4	Windows XP--Attack Scenarios:--Ease of Attack:Simple. Expoit code exists.--False Positives:None known.--False Negatives:None known.--Corrective Action:Apply the appropriate vendor supplied patches.Use a firewall to block access to ports 135, 137, 138, 445, 1801, and3527 for UDP connections and also ports 135, 139, 445, 593, 1801, 2101,2103, 2105, and 2107 for TCP connections from sources external to theprotected network--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--