CVE-2004-0124

Vulnerability

The Object Identity Vulnerability (CVE-2004-0124) exists in the DCOM RPC interface of Microsoft Windows NT 4.0, 2000, XP, and Server 2003. The issue is that the COM (Component Object Model) component creates object identifiers in a predictable manner, allowing an attacker to discover valid object identifiers via a specially crafted "alter context" call containing additional data. Affected versions include Windows NT 4.0 SP6a, Windows 2000 SP2-SP4, Windows XP (including SP1 and 64-Bit Edition), and Windows Server 2003 [1][3].

Exploitation

An attacker can exploit this vulnerability by sending a crafted DCOM RPC request to a target system. The attacker does not require authentication but needs network access to the target. By manipulating the "alter context" call with additional data, the attacker can enumerate valid object identifiers. This information can then be used to trigger the system to open network communication ports that were previously closed or filtered [3].

Impact

Successful exploitation allows an attacker to discover object identifiers, potentially leading to information disclosure about the system. Moreover, the attacker can cause applications to open and communicate over alternate or unexpected ports, bypassing security policies and potentially enabling further attacks. The vulnerability does not directly grant code execution but can facilitate network-based attacks [1][3].

Mitigation

Microsoft released security bulletin MS04-012 on April 13, 2004, providing updates for all affected Windows versions. Customers are recommended to apply the update immediately [1]. No workarounds are documented in the available references. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the publication date.