search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Winsock buffer overflow

Vulnerability Note VU#908276

Original Release Date: 2006-08-08 | Last Revised: 2006-08-08

Overview

A buffer overflow vulnerability in Microsoft Winsock may allow a remote attacker to execute arbitrary code on an affected system.

Description

Winsock (Windows Socket 2) allows network applications to relay data across a network regardless of the network protocol being used. Microsoft's Winsock contains a buffer overflow vulnerability that can allow a remote attacker to execute arbitrary code and gain control of the affected system. Exploitation of this vulnerability occurs when the remote attacker can convince the user to open a specially crafted file or website.

Microsoft's bulletin states that the following Windows operating systems are affected by this vulnerability:

    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP Service Pack 1 and Service Pack 2
    • Microsoft Windows XP Professional x64 Edition
    • Microsoft Windows Server 2003 and Service Pack 1
    • Microsoft Windows Server 2003 for Itanium-based Systems and Service Pack 1
    • Microsoft Windows Server 2003 x64 Edition

Impact

A remote attacker who can successfully convince a user to open a specially crafted file or website may be able to execute arbitrary code and gain control of the affected system.

Solution

Apply an update
Microsoft has released updates in Microsoft Security Bulletin MS06-041 to address this issue.

Workaround

Microsoft lists the following workaround for this vulnerability.

Modify the Autodial DLL

Modifying the Autodial DLL in the Windows registry will prevent specially crafted files and websites from invoking the affected API.

Please see the Microsoft Security Bulletin MS06-041 for further details and cautions regarding use of the Registry Editor.

    1. Click Start, click Run, and type regedit32, click OK
    2. Locate the following key within the Registry Editor: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters
    3. Double click the REG_SZ value AutoDialDLL
    4. Set the value to kernel32.dll
    5. Close the Registry Editor and reboot the system

    * Note that this workaround does NOT fix the underlying vulnerability but will help block known methods of attack.

    Vendor Information

    908276
     
    Affected   Unknown   Unaffected

    Microsoft Corporation

    Updated:  August 08, 2006

    Status

      Vulnerable

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    The vendor has not provided us with any further information regarding this vulnerability.

    Addendum

    Microsoft Corporation has published Microsoft Security Bulletin MS06-041 in response to this issue. Users are encouraged to review this bulletin and apply the referenced patches.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base N/A N/A
    Temporal N/A N/A
    Environmental N/A

    References

    Acknowledgements

    Thanks to Microsoft Security for reporting this vulnerability in Microsoft Security Bulletin MS06-041. Microsoft, in turn, thanks Peter Winter Smith of NGS Software for reporting the vulnerability to them.

    This document was written by Katie Washok.

    Other Information

    CVE IDs: CVE-2006-3440
    Severity Metric: 12.83
    Date Public: 2006-08-08
    Date First Published: 2006-08-08
    Date Last Updated: 2006-08-08 21:09 UTC
    Document Revision: 24

    Sponsored by CISA.