Microsoft Windows SMB/CIFS privilege escalation

MRxSmbCscIoctlOpenForCopyChunk buffer overflow. In additions, there are DoS vulnerabilities not covered by MS06-30...

CVE-2006-2373: Undefined Security Weakness

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHODNEITHER method flag and an arbitrary address, possibly f...