Lucene search

[email protected]CVE-2006-0034

HistoryMay 10, 2006 - 2:14 a.m.

CVE-2006-0034

2006-05-1002:14:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2006-0034

heap-based buffer overflow

crpciomanagerserver::buildcontext

msdtcprx.dll

microsoft distributed transaction coordinator

msdtc

windows nt 4.0

windows 2000

ndrallocate function

vulnerability

nvd

8.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.935 High

EPSS

Percentile

99.1%

JSON

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.

CPENameOperatorVersion
microsoft:distributed_transaction_coordinatormicrosoft distributed transaction coordinatoreq*
microsoft:windows_ntmicrosoft windows nteq4.0
microsoft:windows_xpmicrosoft windows xpeq*
microsoft:windows_2003_servermicrosoft windows 2003 servereqweb
microsoft:windows_2003_servermicrosoft windows 2003 servereqenterprise
microsoft:windows_2003_servermicrosoft windows 2003 servereqenterprise_64-bit
microsoft:windows_2000microsoft windows 2000eq*
microsoft:windows_2003_servermicrosoft windows 2003 servereqr2
microsoft:windows_2003_servermicrosoft windows 2003 servereqstandard

CPE	Name	Operator	Version
microsoft:distributed_transaction_coordinator	microsoft distributed transaction coordinator	eq	*
microsoft:windows_nt	microsoft windows nt	eq	4.0
microsoft:windows_xp	microsoft windows xp	eq	*
microsoft:windows_2003_server	microsoft windows 2003 server	eq	web
microsoft:windows_2003_server	microsoft windows 2003 server	eq	enterprise
microsoft:windows_2003_server	microsoft windows 2003 server	eq	enterprise_64-bit
microsoft:windows_2000	microsoft windows 2000	eq	*
microsoft:windows_2003_server	microsoft windows 2003 server	eq	r2
microsoft:windows_2003_server	microsoft windows 2003 server	eq	standard

References

archives.neohapsis.com/archives/fulldisclosure/2006-05/0238.html

archives.neohapsis.com/archives/fulldisclosure/2006-05/0269.html

secunia.com/advisories/20000

securityreason.com/securityalert/863

securitytracker.com/id?1016047

www.eeye.com/html/research/advisories/AD20060509a.html

www.osvdb.org/25335

www.securityfocus.com/archive/1/433430/100/0/threaded

www.securityfocus.com/archive/1/433677/100/0/threaded

www.securityfocus.com/bid/17906

www.vupen.com/english/advisories/2006/1742

docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-018

exchange.xforce.ibmcloud.com/vulnerabilities/25559

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1222

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1477

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1908

8.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.935 High

EPSS

Percentile

99.1%

JSON

Related for CVE-2006-0034

cvelist1 securityvulns2 prion1 nessus2 checkpoint_advisories1