CVE-2006-3942

Microsoft Windows - Mailslot Ring0 Memory Corruption (MS06-035)

Severity Score

7.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.

El controlador de servidor (srv.sys) en Microsoft Windows NT 4.0, 2000, XP, y Server 2003 permite a atacantes remotos provocar una denegación de servicio (caída del sistema) mediante un mensaje SMB_COM_TRANSACTION que contiene una cadena sin terminación de carácter nulo, lo cual lleva a una referencia a NULL en la función ExecuteTransaction, posiblemente relacionado con una "tubería SMB" (SMB PIPE), también conocida como vulnerabilidad "Mailslot DOS". NOTA: el nombre "Mailslot DOS" es derivado de una investigación inicial imcompleta; la vulnerabilidad no está asociada con un mailslot (ranura de correo).

*Credits: N/A

CVSS Scores

NISTv2 7.8

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-07-21 First Exploit
2006-07-31 CVE Reserved
2006-07-31 CVE Published
2024-08-07 CVE Updated
2024-11-19 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (15)

URL	Tag	Source
http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx	X_refsource_misc
http://securitytracker.com/id?1016606	Vdb Entry
http://securitytracker.com/id?1017035	Vdb Entry
http://www.coresecurity.com/common/showdoc.php?idx=562&idxseccion=10	X_refsource_misc
http://www.osvdb.org/27644	Vdb Entry
http://www.securityfocus.com/archive/1/443287/100/200/threaded	Mailing List
http://www.securityfocus.com/bid/19215	Vdb Entry
http://xforce.iss.net/xforce/alerts/id/231	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27999	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A428	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/2057	2006-07-21

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/21276	2018-10-17
http://www.securityfocus.com/archive/1/449179/100/0/threaded	2018-10-17
http://www.vupen.com/english/advisories/2006/3037	2018-10-17
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-063	2018-10-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Windows 2000 Search vendor "Microsoft" for product "Windows 2000"				*		sp4, fr		Affected
Microsoft Search vendor "Microsoft"		Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"				64-bit Search vendor "Microsoft" for product "Windows 2003 Server" and version "64-bit"		-		Affected
Microsoft Search vendor "Microsoft"		Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"				itanium Search vendor "Microsoft" for product "Windows 2003 Server" and version "itanium"		-		Affected
Microsoft Search vendor "Microsoft"		Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"				r2 Search vendor "Microsoft" for product "Windows 2003 Server" and version "r2"		-		Affected
Microsoft Search vendor "Microsoft"		Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"				sp1 Search vendor "Microsoft" for product "Windows 2003 Server" and version "sp1"		-		Affected
Microsoft Search vendor "Microsoft"		Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"				sp1 Search vendor "Microsoft" for product "Windows 2003 Server" and version "sp1"		itanium		Affected
Microsoft Search vendor "Microsoft"		Windows Xp Search vendor "Microsoft" for product "Windows Xp"				*		64-bit		Affected
Microsoft Search vendor "Microsoft"		Windows Xp Search vendor "Microsoft" for product "Windows Xp"				*		sp1, tablet_pc		Affected
Microsoft Search vendor "Microsoft"		Windows Xp Search vendor "Microsoft" for product "Windows Xp"				*		sp2, tablet_pc		Affected