Microsoft Server Message Block (SMB) is a protocol for sharing data and resources between computers. SMB may crash upon receipt of a crafted SMB_COM_TRANSACTION packet requesting a NetShareEnum transaction. Attackers can use this vulnerability to cause a denial of service. SMB is included in many versions of Microsoft Windows.
SMB will crash if it receives a crafted SMB_COM_TRANSACTION packet requesting a NetShareEnum transaction, with field "Max Param Count" or "Max Data Count" set to zero (0). On exploitation, the crashed host condition exhibits a blue screen. This vulnerability can be exploited by an attacker with access to a user account on the target system. By default, anonymous users have the required access to exploit this vulnerability; therefore on most Windows systems an attacker does not need to be authenticated.
Attackers can cause a denial of service. Attackers might also be able to execute arbitrary code, though this has not been demonstrated or proven.
Apply a patch
For more information about patches, see
Thanks to Ivan Arce of CORE Security Technologies for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
|Date First Published:||2002-08-23|
|Date Last Updated:||2003-07-02 22:59 UTC|