Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MS06-035 | First vendor Publication | N/A |
| Vendor | Microsoft | Last vendor Modification | N/A |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Vulnerability in Server Service Could Allow Remote Code Execution (917159) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:3 | |||
| Oval ID: | oval:org.mitre.oval:def:3 | ||
| Title: | SMB Information Disclosure Vulnerability | ||
| Description: | The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1315 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:600 | |||
| Oval ID: | oval:org.mitre.oval:def:600 | ||
| Title: | Mailslot Heap Overflow Vulnerability | ||
| Description: | Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption and bypasses size restrictions on second-class Mailslot messages. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1314 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Os | 1 | |
| Os | 5 | |
| Os | 3 |
ExploitDB Exploits
| id | Description |
|---|---|
| 2006-07-21 | MS Windows - Mailslot Ring0 Memory Corruption Exploit (MS06-035) |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 27155 | Microsoft Windows Server Service SRV.SYS Crafted Request SMB Information Disc... Windows contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the Server service reuses memory without zeroing it out, which can disclose random information in memory resulting in a loss of confidentiality. |
| 27154 | Microsoft Windows Server Service SRV.SYS First-class Mailslot Message Remote ... A remote overflow exists in Windows. The SRV.SYS fails to validate SMB first-class mailslot messages resulting in a heap overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity, as well as bypass the size restrictions on second-class Mailslot messages. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7046 - Revision : 9 - Type : NETBIOS-DG |
| 2014-01-10 | SMB Trans andx mailslot heap overflow attempt RuleID : 7045 - Revision : 9 - Type : NETBIOS-DG |
| 2014-01-10 | SMB-DS Trans unicode andx mailslot heap overflow attempt RuleID : 7044 - Revision : 9 - Type : NETBIOS |
| 2014-01-10 | SMB-DS Trans andx mailslot heap overflow attempt RuleID : 7043 - Revision : 9 - Type : NETBIOS |
| 2014-01-10 | Microsoft Windows SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7042 - Revision : 15 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans andx mailslot heap overflow attempt RuleID : 7041 - Revision : 14 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7040 - Revision : 17 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans andx mailslot heap overflow attempt RuleID : 7039 - Revision : 16 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans unicode mailslot heap overflow attempt RuleID : 7038 - Revision : 14 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans mailslot heap overflow attempt RuleID : 7037 - Revision : 13 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans unicode mailslot heap overflow attempt RuleID : 7036 - Revision : 17 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows SMB Trans mailslot heap overflow attempt RuleID : 7035 - Revision : 14 - Type : OS-WINDOWS |
Metasploit Database
| id | Description |
|---|---|
| 2006-07-11 | Microsoft SRV.SYS Mailslot Write Corruption |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-10 | Name : It is possible to crash the remote host due to a flaw in the 'server' service. File : smb_nt_ms06-063.nasl - Type : ACT_GATHER_INFO |
| 2006-07-12 | Name : Arbitrary code can be executed on the remote host due to a flaw in the 'Serve... File : smb_kb917159.nasl - Type : ACT_GATHER_INFO |
| 2006-07-11 | Name : Arbitrary code can be executed on the remote host due to a flaw in the 'serve... File : smb_nt_ms06-035.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:12 |
|
| 2016-03-05 17:24:18 |
|
| 2016-03-05 13:24:29 |
|
| 2014-02-17 11:45:25 |
|
| 2014-01-19 21:29:59 |
|
