Vulnerability record · CVE-2006-4691 · published 14 November 2006
CVE-2006-4691: Windows Workstation Service RPC Stack Buffer Overflow
Microsoft · Windows 2000
The NetpManageIPCConnect function in the Windows Workstation service (wkssvc.dll) contains a stack-based buffer overflow. A remote attacker can send a crafted NetrJoinDomain2 RPC message with an overly long hostname to overwrite the stack and execute arbitrary code. The flaw affects Windows 2000 SP4 and XP SP2 and carries a CVSS v2 score of 10.0.
Description
Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS v2 score of 10.0 with network reachability, no authentication, and complete confidentiality, integrity, and availability impact, combined with a very high EPSS percentile.
What it is
The NetpManageIPCConnect function in the Windows Workstation service (wkssvc.dll) contains a stack-based buffer overflow. A remote attacker can send a crafted NetrJoinDomain2 RPC message with an overly long hostname to overwrite the stack and execute arbitrary code. The flaw affects Windows 2000 SP4 and XP SP2 and carries a CVSS v2 score of 10.0.
Impact
Successful exploitation allows remote code execution with the privileges of the Workstation service, which runs as SYSTEM on affected hosts. An attacker could fully compromise the machine, install programs, and alter or delete data.
Attack surface
Reachable over the network via RPC to the Workstation service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker only needs to send a malformed NetrJoinDomain2 request with a long hostname.
Exploitation
The record does not list this CVE in CISA KEV and provides no exploit tags, but EPSS is very high (0.78944, 99.573rd percentile), indicating a strong likelihood of exploitation activity. No public exploit code or in-the-wild reports are confirmed by the supplied references.
What to do
- Apply the Microsoft security update MS06-070 for Windows 2000 SP4 and Windows XP SP2.
- Block or restrict RPC traffic to the Workstation service (port 445 and dynamic RPC ports) at network boundaries.
- Disable the Workstation service on hosts that do not require it.
- Segment legacy Windows 2000 and XP systems from untrusted networks.
- Monitor for and retire unsupported Windows 2000 and XP systems where feasible.
Detection
- Monitor RPC traffic for NetrJoinDomain2 requests containing unusually long hostname parameters.
- Alert on crashes or unexpected restarts of the Workstation service (wkssvc) on Windows 2000 and XP hosts.
- Use host-based detection for stack corruption or anomalous process creation originating from services.exe or svchost.exe hosting wkssvc.
- Review network logs for RPC connections to the Workstation service from unexpected external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-4691 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-4691), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
