search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Server Service Mailslot vulnerable to heap overflow

Vulnerability Note VU#189140

Original Release Date: 2006-07-11 | Last Revised: 2006-07-18


A buffer overflow vulnerability in the Microsoft mailslot server service may allow a remote attacker to execute arbitrary code on a vulnerable system.



A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited to 424 bytes, and can use either the TCP or UDP protocol.


The server driver SRVR.SYS is responsible for handling all Server Message Block (SMB) traffic.

The Problem

A buffer overflow can occur during the processing of mailslot messages.

Note that per Tipping Point, it is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots (mailslots that use UDP) are likely to be affected by this vulnerability.


A remote unauthenticated attacker could execute unauthenitcated arbitrary code with kernel-level privileges.



Apply the patches supplied by Microsoft. See Microsoft Security Bulletin MS06-035 for more details.

Restrict Access

Per Microsoft, restricting access to port 445/tcp to trusted hosts will prevent this vulnerability from being exploited. Note that the Microsoft SMB protocol uses this port.

Vendor Information


Microsoft Corporation Affected

Notified:  July 11, 2006 Updated: July 11, 2006



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group Score Vector



Microsoft Security Response Center reported this issue. Microsoft credits Pedram Amini of Tipping Point with reporting information about this issue to them.

This document was written by Ryan Giobbi.

Other Information

CVE IDs: CVE-2006-1314
Severity Metric: 11.99
Date Public: 2006-07-11
Date First Published: 2006-07-11
Date Last Updated: 2006-07-18 15:30 UTC
Document Revision: 20

Sponsored by CISA.