Vulnerability Note VU#189140

Microsoft Server Service Mailslot vulnerable to heap overflow

Original Release date: 11 Jul 2006 | Last revised: 18 Jul 2006

Overview

A buffer overflow vulnerability in the Microsoft mailslot server service may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Mailslot

A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited to 424 bytes, and can use either the TCP or UDP protocol.

SRVR.SYS

The server driver SRVR.SYS is responsible for handling all Server Message Block (SMB) traffic.

The Problem

A buffer overflow can occur during the processing of mailslot messages.

Note that per Tipping Point, it is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots (mailslots that use UDP) are likely to be affected by this vulnerability.

Impact

A remote unauthenticated attacker could execute unauthenitcated arbitrary code with kernel-level privileges.

Solution

Upgrade

Apply the patches supplied by Microsoft. See Microsoft Security Bulletin MS06-035 for more details.


Restrict Access

Per Microsoft, restricting access to port 445/tcp to trusted hosts will prevent this vulnerability from being exploited. Note that the Microsoft SMB protocol uses this port.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected11 Jul 200611 Jul 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Microsoft Security Response Center reported this issue. Microsoft credits Pedram Amini of Tipping Point with reporting information about this issue to them.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2006-1314
  • Date Public: 11 Jul 2006
  • Date First Published: 11 Jul 2006
  • Date Last Updated: 18 Jul 2006
  • Severity Metric: 11.99
  • Document Revision: 18

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.