Microsoft Windows Server Service Remote Code Execution Vulnerability (921883)
🗓️ 30 Dec 2011 00:00:00Reported by Copyright (C) 2011 Greenbone AGType 
openvas🔗 plugins.openvas.org👁 81 Views
| Reporter | Title | Published | Views | Family All 31 |
|---|---|---|---|---|
 | MS Windows NetpIsRemote() Remote Overflow Exploit (MS06-040) | 10 Aug 200600:00 | – | zdt |
| MS Windows NetpIsRemote() Remote Overflow Expl (MS06-040) (2k3) | 13 Sep 200600:00 | – | zdt |
 | CVE-2006-3439 | 17 Feb 201100:00 | – | circl |
 | Microsoft Windows Server Service RPC Request Buffer Overrun (MS06-040; CVE-2006-3439) | 13 Aug 200600:00 | – | checkpoint_advisories |
| Microsoft Windows Server Service RPC Request Buffer Overrun (MS06-040; CVE-2006-3439) | 13 Aug 200600:00 | – | checkpoint_advisories |
 | CVE-2006-3439 | 9 Aug 200601:00 | – | cve |
 | CVE-2006-3439 | 9 Aug 200601:00 | – | cvelist |
 | Microsoft Server Service - NetpwPathCanonicalize Overflow (MS06-040) (Metasploit) | 17 Feb 201100:00 | – | exploitdb |
| Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) | 10 Aug 200600:00 | – | exploitdb |
| Microsoft Windows - CanonicalizePathName() Remote (MS06-040) | 19 Aug 200600:00 | – | exploitdb |
10
| Source | Link |
|---|---|
| securityfocus | www.securityfocus.com/bid/19409 |
| docs | www.docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-040 |
| securitytracker | www.securitytracker.com/id |
# SPDX-FileCopyrightText: 2011 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.902782");
script_version("2026-04-28T06:28:06+0000");
script_cve_id("CVE-2006-3439");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"creation_date", value:"2011-12-30 11:26:07 +0530 (Fri, 30 Dec 2011)");
script_tag(name:"last_modification", value:"2026-04-28 06:28:06 +0000 (Tue, 28 Apr 2026)");
script_name("Microsoft Windows Server Service Remote Code Execution Vulnerability (921883)");
script_category(ACT_ATTACK);
script_copyright("Copyright (C) 2011 Greenbone AG");
script_family("Windows : Microsoft Bulletins");
script_dependencies("os_detection.nasl");
script_require_ports(139, 445);
script_mandatory_keys("Host/runs_windows");
script_xref(name:"URL", value:"http://securitytracker.com/id?1016667");
script_xref(name:"URL", value:"http://www.securityfocus.com/bid/19409");
script_xref(name:"URL", value:"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-040");
script_tag(name:"impact", value:"Successful exploitation could allow remote code execution by sending a
specially crafted RPC request and can take complete control of an affected system.");
script_tag(name:"affected", value:"- Microsoft Windows XP Service Pack 2 and prior
- Microsoft Windows 2K3 Service Pack 1 and prior
- Microsoft Windows 2000 Service Pack 4 and prior");
script_tag(name:"insight", value:"The flaw is due to a boundary error in the 'CanonicalizePathName()'
function in netapi32.dll and can be exploited to cause a stack-based buffer
overflow via a malicious NetrpPathCanonicalize RPC request with an overly
long path name to the Server Service.");
script_tag(name:"solution", value:"The vendor has released updates. Please see the references for more information.");
script_tag(name:"summary", value:"This host is missing important security update according to
Microsoft Bulletin MS06-040.");
script_tag(name:"qod_type", value:"remote_app");
script_tag(name:"solution_type", value:"VendorFix");
exit(0);
}
include("smb_nt.inc");
name = kb_smb_name();
port = kb_smb_transport();
soc = open_sock_tcp( port );
if( ! soc ) exit( 0 );
## SMB Negotiate Protocol Request
smb_neg_req = raw_string(0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42,
0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02,
0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f,
0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52,
0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02,
0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e,
0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f,
0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57,
0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70,
0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02,
0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30,
0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41,
0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54,
0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32,
0x00);
send( socket:soc, data:smb_neg_req );
## SMB Negotiate Protocol Response
smb_neg_resp = smb_recv( socket:soc );
if( ! smb_neg_resp ) {
close( soc );
exit( 0 );
}
## SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
smb_sess_req = raw_string(0x00, 0x00, 0x00, 0xec, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x42, 0x53, 0x52, 0x53, 0x50, 0x59,
0x4c, 0x20, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
0x00, 0x00, 0x40, 0x00, 0x0c, 0xff, 0x00, 0x00,
0x00, 0x00, 0x44, 0x01, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0x00,
0x00, 0xdc, 0x02, 0x00, 0x80, 0xb1, 0x00, 0x60,
0x48, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05, 0x05,
0x02, 0xa0, 0x3e, 0x30, 0x3c, 0xa0, 0x0e, 0x30,
0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
0x82, 0x37, 0x02, 0x02, 0x0a, 0xa2, 0x2a, 0x04,
0x28, 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50,
0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x82, 0x08,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x05, 0x01, 0x28, 0x0a, 0x00, 0x00, 0x00,
0x0f, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00,
0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
0x32, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00,
0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
0x63, 0x00, 0x6b, 0x00, 0x20, 0x00, 0x32, 0x00,
0x20, 0x00, 0x32, 0x00, 0x36, 0x00, 0x30, 0x00,
0x30, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00,
0x73, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00,
0x30, 0x00, 0x32, 0x00, 0x20, 0x00, 0x35, 0x00,
0x2e, 0x00, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00);
send( socket:soc, data:smb_sess_req );
## SMB Session Setup AndX Response, NTLMSSP_CHALLENGE,
## Error: STATUS_MORE_PROCESSING_REQUIRED
smb_sess_resp = smb_recv( socket:soc );
if( ! smb_sess_resp ) {
close( soc );
exit( 0 );
}
##Extract UID from Session Setup AndX Response
if( smb_sess_resp && strlen( smb_sess_resp ) > 33 ) {
uid_low = ord( smb_sess_resp[32] );
uid_high = ord( smb_sess_resp[33] );
uid = uid_high * 256;
uid += uid_low;
} else {
exit( 0 );
}
## SMB Session Setup AndX Request, NTLMSSP_AUTH, User: \
smb_sess_andx_req = raw_string(0x00, 0x00, 0x01, 0x02, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x42, 0x53, 0x52, 0x53, 0x50, 0x59,
0x4c, 0x20, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6)
+ raw_string( uid_low, uid_high ) +
raw_string( 0x80, 0x00, 0x0c, 0xff, 0x00, 0x00,
0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x00,
0x00, 0xdc, 0x02, 0x00, 0x80, 0xc7, 0x00, 0xa1,
0x5f, 0x30, 0x5d, 0xa2, 0x5b, 0x04, 0x59, 0x4e,
0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03,
0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x48,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x49,
0x00, 0x00, 0x00, 0x05, 0x02, 0x08, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
0x77, 0x24, 0xb3, 0x5b, 0xd0, 0xee, 0x67, 0x99,
0xa6, 0x5b, 0x68, 0xa4, 0x4f, 0x0e, 0xeb, 0x56,
0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00,
0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x32, 0x00,
0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00,
0x20, 0x00, 0x50, 0x00, 0x61, 0x00, 0x63, 0x00,
0x6b, 0x00, 0x20, 0x00, 0x32, 0x00, 0x20, 0x00,
0x32, 0x00, 0x36, 0x00, 0x30, 0x00, 0x30, 0x00,
0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00,
0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
0x32, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2e, 0x00,
0x31, 0x00, 0x00, 0x00, 0x00, 0x00);
send( socket:soc, data:smb_sess_andx_req );
## SMB Session Setup AndX Response
smb_sess_andx_resp = smb_recv( socket:soc );
if( ! smb_sess_andx_resp ) {
close( soc );
exit( 0 );
}
## SMB Tree Connect AndX Request, Path: \\xxx.xxx.xxx.xxx\IPC$
smb_tree_resp = smb_tconx( soc:soc, name:name, uid:uid, share:"IPC$" );
if( ! smb_tree_resp ) {
close( soc );
exit( 0 );
}
## NT Create AndX Request, FID: 0x4000, Path: \browser
nt_creat_req = raw_string(0x00, 0x00, 0x00, 0x66, 0xff, 0x53, 0x4d, 0x42,
0xa2, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0x00, 0x01, 0x18, 0xff, 0x00, 0x00,
0x00, 0x00, 0x10, 0x00, 0x16, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x9f, 0x01, 0x12, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x40, 0x00,
0x02, 0x00, 0x00, 0x00, 0x03, 0x13, 0x00, 0x00,
0x5c, 0x00, 0x62, 0x00, 0x72, 0x00, 0x6f, 0x00,
0x77, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00,
0x00, 0x00);
send( socket:soc, data:nt_creat_req );
nt_creat_resp = smb_recv( socket:soc );
if( ! nt_creat_resp ) {
close( soc );
exit( 0 );
}
## DCERPC Bind: call_id: 0 SRVSVC V3.0
dcerpc_bind_req = raw_string(0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0x40, 0x01, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x48, 0x00, 0x00,
0x00, 0x48, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00,
0x00, 0x49, 0x00, 0x00, 0x05, 0x00, 0x0b, 0x03,
0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b,
0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47,
0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00);
send( socket:soc, data:dcerpc_bind_req );
dcerpc_bind_resp = smb_recv( socket:soc );
if( ! dcerpc_bind_resp ) {
close( soc );
exit( 0 );
}
## Read AndX Request, FID: 0x4000
read_andx_req = raw_string(0x00, 0x00, 0x00, 0x3c, 0xff, 0x53, 0x4d, 0x42,
0x2e, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0x80, 0x01, 0x0c, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
0x04, 0x00, 0x04, 0xff, 0xff, 0xff, 0xff, 0x00,
0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
send( socket:soc, data:read_andx_req );
read_andx_resp = smb_recv( socket:soc );
if( ! read_andx_resp ) {
close( soc );
exit( 0 );
}
## Packet type: 12 (Bind_ack) @ offset 66 - 1 byte
## Auth Length: 00 @ Offset 74 - 2 bytes
## Call ID : 00 @ Offset 76 - 4 bytes
if( strlen( read_andx_resp ) > 79 &&
! ( ord( read_andx_resp[66] ) == 12 && ord( read_andx_resp[74] ) == 00 &&
ord( read_andx_resp[75] ) == 00 && ord( read_andx_resp[76] ) == 00 &&
ord( read_andx_resp[77] ) == 00 && ord( read_andx_resp[78] ) == 00 &&
ord( read_andx_resp[79] ) == 00 ) ) {
close( soc );
exit( 0 );
}
## NetPathCanonicalize request
netpath_can_req = raw_string(0x00, 0x00, 0x00, 0xb8, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0xc0, 0x01, 0x10, 0x00, 0x00, 0x64,
0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x54, 0x00, 0x64, 0x00, 0x54, 0x00, 0x02,
0x00, 0x26, 0x00, 0x00, 0x40, 0x75, 0x00, 0x00,
0x5c, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00,
0x45, 0x00, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00,
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x64, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x4c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x00,
0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
0x6d, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x07, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x70, 0x00,
0x65, 0x00, 0x6e, 0x00, 0x56, 0x41, 0x53, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00);
send( socket:soc, data:netpath_can_req );
netpath_can_resp = smb_recv( socket:soc );
if( ! netpath_can_resp ) {
close( soc );
exit( 0 );
}
## SRVSVC NetPathCanonicalize request
netpath_req = raw_string(0x00, 0x00, 0x00, 0xac, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0x00, 0x02, 0x10, 0x00, 0x00, 0x58,
0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x54, 0x00, 0x58, 0x00, 0x54, 0x00, 0x02,
0x00, 0x26, 0x00, 0x00, 0x40, 0x69, 0x00, 0x00,
0x5c, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00,
0x45, 0x00, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00,
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x58, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x00,
0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
0x6d, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
send( socket:soc, data:netpath_req );
netpath_resp = smb_recv( socket:soc );
if( ! netpath_resp ) {
close( soc );
exit( 0 );
}
## SMB Tree Disconnect Request
smb_tree_dis_req = raw_string(0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42,
0x71, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
0x00, 0x08, 0x40, 0x02, 0x00, 0x00, 0x00);
send( socket:soc, data:smb_tree_dis_req );
smb_tree_dis_resp = smb_recv( socket:soc );
if( ! smb_tree_dis_resp ) {
close( soc );
exit( 0 );
}
## SMB Logoff AndX Request
smb_logoff_req = raw_string(0x00, 0x00, 0x00, 0x27, 0xff, 0x53, 0x4d, 0x42,
0x74, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
0x00, 0x08, 0x80, 0x02, 0x02, 0xff, 0x00, 0x00,
0x00, 0x00, 0x00);
send( socket:soc, data:smb_logoff_req );
smb_logoff_resp = smb_recv( socket:soc );
if( ! smb_logoff_resp ) {
close( soc );
exit( 0 );
}
close( soc );
## After applying the patch these fields will filled with '00'
if( strlen( netpath_resp ) > 98 &&
ord( netpath_resp[88] ) == 79 && ord( netpath_resp[90] ) == 112 &&
ord( netpath_resp[92] ) == 101 && ord( netpath_resp[94] ) == 110 &&
ord( netpath_resp[96] ) == 86 && ord( netpath_resp[97] ) == 65 &&
ord( netpath_can_resp[98] ) == 83 ) {
security_message( port:port );
exit( 0 );
}
exit( 99 );
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Apr 2026 00:00Current
4.9Medium risk
Vulners AI Score4.9
CVSS 210
EPSS0.84957