9 - MS06-063

Executive Summary

Informations
Name	MS06-063	First vendor Publication	2006-10-10
Vendor	Microsoft	Last vendor Modification	2006-10-10
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Cvss Base Score	9	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability in Server Service Could Allow Denial of Service and Remote Code Execution (923414)

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-94	Failure to Control Generation of Code ('Code Injection')
50 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:428

Oval ID:	oval:org.mitre.oval:def:428
Title:	Server Service Denial of Service Vulnerability
Description:	The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-3942	Version:	4
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003	Product(s):
Definition Synopsis:
Win2K,SP4 Microsoft Windows 2000 SP4 or later is installed AND the version of srv.sys is less than 5.0.2195.7106 OR WinXP,SP1 Microsoft Windows XP SP1 (32-bit) is installed AND the version of srv.sys is less than 5.1.2600.1885 OR WinXP,SP2 Microsoft Windows XP SP2 or later is installed AND the version of srv.sys is less than 5.1.2600.2974 OR WinXP,SP1 (64-bit) Microsoft Windows XP SP1 (64-bit) is installed AND the version of srv.sys is less than 5.2.3790.2783 OR S03-Gold Microsoft Windows Server 2003 (x86) Gold is installed AND the version of srv.sys is less than 5.2.3790.588 OR S03,SP1 Microsoft Windows Server 2003 SP1 (x86) is installed AND the version of srv.sys is less than 5.2.3790.2783

Definition Id: oval:org.mitre.oval:def:8

Oval ID:	oval:org.mitre.oval:def:8
Title:	SMB Rename Vulnerability
Description:	Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet, aka "SMB Rename Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-4696	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003	Product(s):
Definition Synopsis:
Win2K,SP4 Microsoft Windows 2000 SP4 or later is installed AND the version of srv.sys is less than 5.0.2195.7106 OR WinXP,SP1 Microsoft Windows XP SP1 (32-bit) is installed AND the version of srv.sys is less than 5.1.2600.1885 OR WinXP,SP2 Microsoft Windows XP SP2 or later is installed AND the version of srv.sys is less than 5.1.2600.2974 OR WinXP,SP1 (64-bit) Microsoft Windows XP SP1 (64-bit) is installed AND the version of srv.sys is less than 5.2.3790.2783 OR S03-Gold Microsoft Windows Server 2003 (x86) Gold is installed AND the version of srv.sys is less than 5.2.3790.588 OR S03,SP1 Microsoft Windows Server 2003 SP1 (x86) is installed AND the version of srv.sys is less than 5.2.3790.2783

CPE : Common Platform Enumeration

Type	Description	Count
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000::sp4::fr::::	1
Os	Microsoft Windows 2003 Server cpe:2.3:o:microsoft:windows_2003_server:64-bit:::::::* cpe:2.3:o:microsoft:windows_2003_server:sp1:::::::* cpe:2.3:o:microsoft:windows_2003_server:sp1::itanium::::: cpe:2.3:o:microsoft:windows_2003_server:r2:::::::* cpe:2.3:o:microsoft:windows_2003_server:itanium:::::::*	5
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp::sp2:tablet_pc::::: cpe:2.3:o:microsoft:windows_xp:::64-bit:::::* cpe:2.3:o:microsoft:windows_xp::sp1:tablet_pc::::: cpe:2.3:o:microsoft:windows_xp::gold::::::*	4

Open Source Vulnerability Database (OSVDB)

Id	Description
29439	Microsoft Windows Server Service Crafted SMB Packet Unspecified Issue
27644	Microsoft Windows Server Driver (srv.sys) Crafted SMB Packet NULL Dereference... Windows contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker sends a specially crafted SMB packet to the Server service (srv.sys), and will result in loss of availability for the platform.

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Windows SMB Rename invalid buffer type unicode attempt RuleID : 8460 - Revision : 9 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type unicode andx attempt RuleID : 8459 - Revision : 9 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type attempt RuleID : 8458 - Revision : 9 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type andx attempt RuleID : 8457 - Revision : 9 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB-DS Rename invalid buffer type unicode attempt RuleID : 8456 - Revision : 11 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB-DS Rename invalid buffer type unicode andx attempt RuleID : 8455 - Revision : 11 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB-DS Rename invalid buffer type attempt RuleID : 8454 - Revision : 11 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB-DS Rename invalid buffer type andx attempt RuleID : 8453 - Revision : 11 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type unicode attempt RuleID : 8452 - Revision : 10 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type unicode andx attempt RuleID : 8451 - Revision : 10 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type attempt RuleID : 8450 - Revision : 10 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Rename invalid buffer type andx attempt RuleID : 8449 - Revision : 10 - Type : OS-WINDOWS
2014-01-10	SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7046 - Revision : 9 - Type : NETBIOS-DG
2014-01-10	SMB Trans andx mailslot heap overflow attempt RuleID : 7045 - Revision : 9 - Type : NETBIOS-DG
2014-01-10	SMB-DS Trans unicode andx mailslot heap overflow attempt RuleID : 7044 - Revision : 9 - Type : NETBIOS
2014-01-10	SMB-DS Trans andx mailslot heap overflow attempt RuleID : 7043 - Revision : 9 - Type : NETBIOS
2014-01-10	Microsoft Windows SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7042 - Revision : 15 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans andx mailslot heap overflow attempt RuleID : 7041 - Revision : 14 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans unicode andx mailslot heap overflow attempt RuleID : 7040 - Revision : 17 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans andx mailslot heap overflow attempt RuleID : 7039 - Revision : 16 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans unicode mailslot heap overflow attempt RuleID : 7038 - Revision : 14 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans mailslot heap overflow attempt RuleID : 7037 - Revision : 13 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans unicode mailslot heap overflow attempt RuleID : 7036 - Revision : 17 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows SMB Trans mailslot heap overflow attempt RuleID : 7035 - Revision : 14 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows Server driver crafted SMB data denial of service RuleID : 16066 - Revision : 12 - Type : OS-WINDOWS

Metasploit Database

id	Description
2020-05-23	Microsoft SRV.SYS Pipe Transaction No Null

Nessus® Vulnerability Scanner

Date	Description
2006-10-10	Name : It is possible to crash the remote host due to a flaw in the 'server' service. File : smb_nt_ms06-063.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2020-05-23 13:17:12	Multiple Updates
2016-03-06 17:24:10	Multiple Updates
2016-03-06 13:24:49	Multiple Updates
2014-02-17 11:45:31	Multiple Updates
2014-01-19 21:30:01	Multiple Updates
2013-05-11 12:21:55	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	2
CPE ID(s)	10
osvdb(s)	2
Metasploit Exploit(s)	1
Snort® Rule(s)	25
Nessus® Exploit(s)	1

	Related
10	MS08-063
9	CVE-2006-4696
7.8	CVE-2006-3942
0	HPSBST02161 SSR...
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)

9 - MS06-063

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Open Source Vulnerability Database (OSVDB)

Snort® IPS/IDS

Metasploit Database

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU