SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#901584

Microsoft Windows SNMP Memory Corruption Vulnerability

Overview

A vulnerability in the way Microsoft Windows handles SNMP may allow a buffer overflow that may allow remote execution of arbitrary code.

I. Description

Microsoft Windows contains a buffer overflow that may occur when handling malformed SNMP packets. According to Microsoft Security Bulletin ms06-074 the exploit is triggered by sending a specially crafted SNMP packet to a vulnerable system.

Note that the SNMP service is not installed on any version of Microsoft Windows by default.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition.

III. Solution

Update

Microsoft has released an update to address this issue. See Microsoft Security Bulletin ms06-074 for more details.

Apply a Workaround

  • Block UDP port 161
  • Disable SNMP service - Note that according to Microsoft Security Bulletin ms06-074:
    If you disable the SNMP service, you may not be able to monitor systems via SNMP.

See Microsoft Security Bulletin ms06-074 for more details.

Systems Affected
VendorStatusDate NotifiedDate Updated
Microsoft CorporationVulnerable12-Dec-2006

References


http://www.microsoft.com/technet/security/bulletin/ms06-074.mspx
http://secunia.com/advisories/23307/

Credit

This vulnerability was reported in Microsoft Security Bulletin ms06-074. Microsoft credits Kostya Kortchinsky of Immunity, Inc. and Clement Seguy of the European Aeronautic Defence and Space Company for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public:2006-12-12
Date First Published:2006-12-13
Date Last Updated:2007-01-05
CERT Advisory: 
CVE-ID(s):CVE-2006-5583
NVD-ID(s):CVE-2006-5583
US-CERT Technical Alerts: 
Metric:16.40
Document Revision:17

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader