Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability

2006.07.14
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability http://www.tippingpoint.com/security/advisories/TSRT-06-02.html July 11, 2006 -- CVE ID: CVE-2006-1314 -- Affected Vendor: Microsoft -- Affected Products: Windows 2000 Windows XP SP1 Windows XP SP2 Windows 2003 Windows 2003 SP1 -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability since July 11, 2006 by Digital Vaccine protection filter ID 4266. For further product information on the TippingPoint IPS: http://www.tippingpoint.com -- Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Microsoft Windows operating system. Authentication is not required to exploit this vulnerability and code execution occurs within the context of the kernel. According to the Microsoft Developer Network (MSDN) documentation, Mailslot communications are divided into two classes. First-class Mailslots are connection oriented and operate over SMB/TCP. Second-class Mailslots provide connectionless messaging for broadcast messages and operate over SMB/UDP. Second-class Mailslots are limited to 424 bytes per message. First-class Mailslots are officially unsupported in the Windows 2000, XP and 2003 operating systems. The specific flaw exists within the SRV.SYS driver, which is responsible for handling all Server Message Block (SMB) traffic. During the processing of first-class Mailslot messages, an exploitable memory corruption condition is created. As a side effect, attackers are also capable of exceeding the second-class Mailslot message size limitation. It is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots are likely to be affected by this vulnerability. -- Vendor Response: Microsoft has issued an update to correct this vulnerability. More details can be found at: http://www.microsoft.com/technet/security/bulletin/MS06-035.mspx -- Disclosure Timeline: 2006.03.01 - Vulnerability reported to vendor 2006.07.11 - Digital Vaccine released to TippingPoint customers 2006.07.11 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Pedram Amini, TippingPoint Security Research Team in collaboration with HD Moore, Metasploit.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top