search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Microsoft Server Service Mailslot vulnerable to heap overflow

Vulnerability Note VU#189140

Original Release Date: 2006-07-11 | Last Revised: 2006-07-18

Overview

A buffer overflow vulnerability in the Microsoft mailslot server service may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Mailslot

A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited to 424 bytes, and can use either the TCP or UDP protocol.

SRVR.SYS

The server driver SRVR.SYS is responsible for handling all Server Message Block (SMB) traffic.

The Problem

A buffer overflow can occur during the processing of mailslot messages.

Note that per Tipping Point, it is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots (mailslots that use UDP) are likely to be affected by this vulnerability.

Impact

A remote unauthenticated attacker could execute unauthenitcated arbitrary code with kernel-level privileges.

Solution

Upgrade

Apply the patches supplied by Microsoft. See Microsoft Security Bulletin MS06-035 for more details.


Restrict Access

Per Microsoft, restricting access to port 445/tcp to trusted hosts will prevent this vulnerability from being exploited. Note that the Microsoft SMB protocol uses this port.

Vendor Information

189140
Expand all

Microsoft Corporation

Notified:  July 11, 2006 Updated:  July 11, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Microsoft Security Response Center reported this issue. Microsoft credits Pedram Amini of Tipping Point with reporting information about this issue to them.

This document was written by Ryan Giobbi.

Other Information

CVE IDs: CVE-2006-1314
Severity Metric: 11.99
Date Public: 2006-07-11
Date First Published: 2006-07-11
Date Last Updated: 2006-07-18 15:30 UTC
Document Revision: 18

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.