CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
98.3%
A buffer overflow vulnerability in Microsoft Winsock may allow a remote attacker to execute arbitrary code on an affected system.
Winsock (Windows Socket 2) allows network applications to relay data across a network regardless of the network protocol being used. Microsoft’s Winsock contains a buffer overflow vulnerability that can allow a remote attacker to execute arbitrary code and gain control of the affected system. Exploitation of this vulnerability occurs when the remote attacker can convince the user to open a specially crafted file or website.
Microsoft’s bulletin states that the following Windows operating systems are affected by this vulnerability:
* Microsoft Windows 2000 Service Pack 4
* Microsoft Windows XP Service Pack 1 and Service Pack 2
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 and Service Pack 1
* Microsoft Windows Server 2003 for Itanium-based Systems and Service Pack 1
* Microsoft Windows Server 2003 x64 Edition
A remote attacker who can successfully convince a user to open a specially crafted file or website may be able to execute arbitrary code and gain control of the affected system.
Apply an update
Microsoft has released updates in Microsoft Security Bulletin MS06-041 to address this issue.
Workaround
Microsoft lists the following workaround for this vulnerability.
Modify the Autodial DLL
Modifying the Autodial DLL in the Windows registry will prevent specially crafted files and websites from invoking the affected API.
Please see the Microsoft Security Bulletin MS06-041 for further details and cautions regarding use of the Registry Editor.
908276
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: August 08, 2006
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Microsoft Corporation has published Microsoft Security Bulletin MS06-041 in response to this issue. Users are encouraged to review this bulletin and apply the referenced patches.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23908276 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
<http://www.microsoft.com/technet/security/bulletin/ms06-041.mspx>
Thanks to Microsoft Security for reporting this vulnerability in Microsoft Security Bulletin MS06-041. Microsoft, in turn, thanks Peter Winter Smith of NGS Software for reporting the vulnerability to them.
This document was written by Katie Washok.
CVE IDs: | CVE-2006-3440 |
---|---|
Severity Metric: | 12.83 Date Public: |