MS05-039 Scan

The MS05-039 Scan application was designed to be a Windows based detection and analysis utility that can quickly and accurately identify Microsoft operating systems that are vulnerable to the multiple buffer overflow vulnerabilities released in the MS05-039 bulletin.

MS05-039 Scan is intended for use by enterprise system and network administrators as a fast and reliable utility for identifying at risk Microsoft systems in a passive manner. This tool is non-abrasive in nature and may be run in production environments during production hours.

Vulnerability Information: There is a remotely exploitable vulnerability in the Plug and Play (PnP) RPC interface in Microsoft Windows.

Using a null session, an attacker could make an RPC request to the PnP interface on a Microsoft Windows system that could potentially execute arbitrary code.

This Foundstone check detects the absence of the patch by attempting to trigger the vulnerability in a nonintrusive manner over RPC.