Windows SMB NTLM Authentication Weak Nonce

Windows SMB NTLM Authentication Weak Nonce Vulnerability Security Advisory Hernan Ochoa [email protected] - Agustin Azubel [email protected] Title: Windows SMB NTLM Authentication Weak Nonce Vulnerability Advisory ID: OCHOA-2010-0209 Advisory URL:...

stratsec Security Advisory SS-2010-003 - Microsoft SMB Client Pool Overflow

=============================================================================== Stratsec Security Advisory: SS-2010-003 =============================================================================== Title: Microsoft SMB Client Pool Overflow MS10-006 Version: 1.0 Issue type: Pool overflow Affecte...

Microsoft Windows SMB Client Pool Corruption (MS10-006; CVE-2010-0016)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A remote code execution vulnerability has been reported in the Microsoft Server Message Block SMB Protocol. The vulnerability is due to an error in the Microsoft SMB implementation that improperly...

Microsoft SMB COPY Command Pathname Overflow (MS10-012; CVE-2010-0020)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A remote code execution vulnerability has been reported in the Microsoft Windows Server Message Block SMB implementation. The vulnerability is due to an error in the Windows SMB server that fails to...

Microsoft Windows SMB Pathname Remote Buffer Overflow Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability that affects the Microsoft Server Message Block SMB protocol software. An authenticated attacker can exploit this issue to execute code with SYSTEM-level privileges. Failed exploit attempts will likely cause...

Microsoft SMB NTLM Authentication Lack of Entropy (MS10-012; CVE-2010-0231)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. An elevation of privilege vulnerability has been reported in the way that Microsoft Server Message Block SMB Protocol software handles authentication attempts. The vulnerability is due to a lack of...

Microsoft SMB Server Null Pointer Denial of Service (MS10-012; CVE-2010-0022; CVE-2010-0023)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A denial of service vulnerability has been reported in the Microsoft Windows Server Message Block SMB implementation. The vulnerability is due to insufficient validation by the Microsoft SMB Protocol...

Microsoft to Patch 26 Windows, Office Vulnerabilities

Microsoft’s February batch of security patches will be a biggie — 13 bulletins with fixes for a whopping 26 vulnerabilities. According to an advance notice from the Redmond, Wash. software vendor, five of the 13 bulletins will be rated “critical” because of the risk of remote code execution...

Microsoft SMB Server Race Condition Denial of Service (MS10-012; CVE-2010-0021)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A denial of service vulnerability has been reported in the Microsoft Windows Server Message Block SMB implementation. The vulnerability is due to a race condition in a driver that is part of the SMB stac...

MS Confirms Windows 7 DoS Flaw

On the heels of last week’s release of exploit code for a crippling denial-of-service vulnerability in Windows 7 and Windows Server 2008 R2, Microsoft has issued a security advisory to confirm the issue and offer pre-patch mitigations. The flaw, in the Microsoft Server Message Block SMB Protocol...

Microsoft SMB Endless Loop Denial of Service (CVE-2009-3676)

The SMB Protocol is a network file sharing protocol. A denial of service vulnerability has been reported in the way that Microsoft Server Message Block SMB protocol software handles specially crafted SMB packets. The vulnerability is due to an error in the Microsoft Server Message Block SMB...

Microsoft SMB Infinite Loop Denial of Service (MS09-050; CVE-2009-2526)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A denial of service vulnerability has been reported in the way that Microsoft Server Message Block SMB Protocol software handles specially crafted SMB version 2 SMBv2 packets. The vulnerability is due to...

Microsoft Windows SMB Negotiate Request Remote Code Execution (CVE-2009-2532; CVE-2009-3103)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A remote code execution vulnerability has been reported in the Microsoft Server Message Block SMB Protocol. The vulnerability is due to a memory corruption error in the Microsoft Server Message Block SMB...

VideoLAN VLC Media Player 1.0.0/1.0.1 - 'smb://' URI Handling Buffer Overflow (PoC)

!/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original: http://www.milw0rm.com/exploits/9303 Crash Breakdown of vlc v1.0.1 on XP...

VLC 0.8.6f smb:// Universal Buffer Overflow

!/usr/bin/python Exploit : VLC Media Player 0.8.6f smb:// URI Handling Remote BOF Exploit univ Credits : Pankaj Kohli Exploit : His0k4 header1= "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31" "\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22\x55\x54"...

VideoLAN VLC Media Player 0.9.9 - smb: URI Stack Buffer Overflow (PoC)

VideoLAN VLC Media Player 0.9.9 - smb: URI Stack Buffer Overflow PoC !/usr/bin/ruby VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow Proof-of-Concept Bugtraq ID: 35500 The vulnerability can also be triggered via the VLC web interface disabled by default:...

Windows SMB credential reflection vulnerability

Added: 05/07/2009 CVE: CVE-2008-4037 BID: 7385 OSVDB: 49736 Background The Server Message Block SMB protocol is a file sharing protocol implemented in Microsoft Windows. NTLM is a challenge/response-based authentication protocol. Problem An NTLM credential reflection vulnerability allows a remote...

CentOS 4 : elinks (CESA-2006:0742)

An updated elinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Elinks is a text mode Web browser used from the command line that supports renderi...

Fedora Update for samba FEDORA-2007-219

Check for the Version of samba OpenVAS Vulnerability Test Fedora Update for samba FEDORA-2007-219 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Microsoft Windows WRITE_ANDX SMB Processing Denial of Service (CVE-2008-4114)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A remote denial of service vulnerability was reported in Microsoft Windows. Windows fails to properly handle crafted Server Message Block SMB packets. SMB is Microsoft Windows native networking protocol,...