CVE-2006-6696
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server…
Does this matter?
Lower severity and a low EPSS score (3.39%). Track it; it rarely justifies an emergency change on its own.
Description
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 3.39% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/windows 2000 · microsoft/windows 2003 server · microsoft/windows vista · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx
- http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff
- http://isc.sans.org/diary.php?n&storyid=1965
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051394.html
- http://research.eeye.com/html/alerts/zeroday/20061215.html
- http://secunia.com/advisories/23448Vendor Advisory
- http://securitytracker.com/id?1017433
- http://www.determina.com/security.research/vulnerabilities/csrss-harderror.html
- http://www.kuban.ru/forum_new/forum2/files/19124.html
- http://www.security.nnov.ru/Gnews944.html
- http://www.security.nnov.ru/files/messagebox.c
- http://www.securityfocus.com/archive/1/455061/100/0/threaded
- http://www.securityfocus.com/archive/1/455088/100/0/threaded
- http://www.securityfocus.com/archive/1/455104/100/0/threaded
- http://www.securityfocus.com/archive/1/455158/100/0/threaded
- http://www.securityfocus.com/archive/1/455546/100/0/threaded
- http://www.securityfocus.com/archive/1/466331/100/200/threaded
- http://www.securityfocus.com/bid/21688
- http://www.securityfocus.com/bid/23324
- http://www.vupen.com/english/advisories/2006/5120
- http://www.vupen.com/english/advisories/2007/1325
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-021
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1816
- http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx
- http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff
- http://isc.sans.org/diary.php?n&storyid=1965
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051394.html
- http://research.eeye.com/html/alerts/zeroday/20061215.html
- http://secunia.com/advisories/23448Vendor Advisory
- http://securitytracker.com/id?1017433
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.