Vulnerability Note VU#311619

Microsoft Windows Server Message Block (SMB) fails to properly handle SMB_COM_TRANSACTION packets requesting NetServerEnum3 transaction

Original Release date: 23 Aug 2002 | Last revised: 26 Aug 2002

Overview

Microsoft Server Message Block (SMB) may crash upon receipt of a crafted SMB_COM_TRANSACTION packet requesting a NetServerEnum3 transaction. Attackers can use this vulnerability to cause a denial of service.

Description

SMB is a protocol for sharing data and resources between computers, included in many versions of Microsoft Windows.

SMB may crash if it receives a crafted SMB_COM_TRANSACTION packet requesting a NetServerEnum2 transaction. If either the 'Max Param Count' field or 'Max Data Count' field of the packet is set to zero (0), the destination SMB host will crash with a blue screen. This vulnerability can be exploited by both local and remote attackers.

Impact

Remote attackers can cause a denial of service. Attackers may also be able to execute arbitrary code, though this has not been demonstrated or proven.

Solution

Apply a patch

For more information, see:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS02-045.asp

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected15 Jul 200223 Aug 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Ivan Arce of CORE Security Technologies for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

  • CVE IDs: Unknown
  • Date Public: 22 Aug 2002
  • Date First Published: 23 Aug 2002
  • Date Last Updated: 26 Aug 2002
  • Severity Metric: 0.87
  • Document Revision: 9

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.