Vulnerability Note VU#189140

Microsoft Server Service Mailslot vulnerable to heap overflow

A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited to 424 bytes, and can use either the TCP or UDP protocol.

SRVR.SYS

The server driver SRVR.SYS is responsible for handling all Server Message Block (SMB) traffic.

The Problem

A buffer overflow can occur during the processing of mailslot messages.

Note that per Tipping Point, it is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots (mailslots that use UDP) are likely to be affected by this vulnerability.

II. Impact

Apply the patches supplied by Microsoft. See Microsoft Security Bulletin MS06-035 for more details.

Restrict Access

Per Microsoft, restricting access to port 445/tcp to trusted hosts will prevent this vulnerability from being exploited. Note that the Microsoft SMB protocol uses this port.

Systems Affected

http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx
http://www.tippingpoint.com/security/advisories/TSRT-06-02.html
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ipc/base/about_mailslots.asp
http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx

Credit

Microsoft Security Response Center reported this issue. Microsoft credits Pedram Amini of Tipping Point with reporting information about this issue to them.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.