CVE-2009-3103
Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 90.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 90.23% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/windows server 2008 · microsoft/windows vista
- Source
- secure@microsoft.com
References
- http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.htmlExploit
- http://blog.48bits.com/?p=510
- http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.htmlExploit
- http://isc.sans.org/diary.html?storyid=7093
- http://osvdb.org/57799
- http://secunia.com/advisories/36623Vendor Advisory
- http://www.exploit-db.com/exploits/9594
- http://www.kb.cert.org/vuls/id/135940US Government Resource
- http://www.microsoft.com/technet/security/advisory/975497.mspxVendor Advisory
- http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1
- http://www.securityfocus.com/archive/1/506300/100/0/threaded
- http://www.securityfocus.com/archive/1/506327/100/0/threaded
- http://www.securityfocus.com/bid/36299Exploit
- http://www.securitytracker.com/id?1022848
- http://www.us-cert.gov/cas/techalerts/TA09-286A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53090
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6489
- http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.htmlExploit
- http://blog.48bits.com/?p=510
- http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.htmlExploit
- http://isc.sans.org/diary.html?storyid=7093
- http://osvdb.org/57799
- http://secunia.com/advisories/36623Vendor Advisory
- http://www.exploit-db.com/exploits/9594
- http://www.kb.cert.org/vuls/id/135940US Government Resource
- http://www.microsoft.com/technet/security/advisory/975497.mspxVendor Advisory
- http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1
- http://www.securityfocus.com/archive/1/506300/100/0/threaded
- http://www.securityfocus.com/archive/1/506327/100/0/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.