Windows SMB2 buffer overflow

Added: 09/20/2010 CVE: CVE-2009-3103 BID: 36299 OSVDB: 57799 Background SMB2 is the replacement protocol for the SMB Windows filesharing protocol. Problem A buffer overflow vulnerability in the SMB2 Service allows remote attackers to execute arbitrary commands. Resolution Apply the patch referenc...

Mandriva Linux Security Advisory : wireshark (MDVSA-2010:016)

This advisory updates wireshark to the latest 1.2.5 version, fixing several bugs and two security issues : - The 1 SMB and 2 SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service crash via a crafted packet CVE-2009-4377 - Buffer overflow in the...

GLSA-201006-05 : Wireshark: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201006-05 Wireshark: Multiple vulnerabilities Multiple vulnerabilities were found in the Daintree SNA file parser, the SMB, SMB2, IPMI, and DOCSIS dissectors. For further information please consult the CVE entries referenced below...

CVE-2010-1906

tgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation, and Subscriber Agent relies on a predictable timestamp field to validate input to the \.\pipe\RepairServicepipecompany named pipe, which allows remote authenticated users to execute arbitrary code by...

Code injection

tgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation, and Subscriber Agent relies on a predictable timestamp field to validate input to the \.\pipe\RepairServicepipecompany named pipe, which allows remote authenticated users to execute arbitrary code by...

CVE-2010-1906

tgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation, and Subscriber Agent relies on a predictable timestamp field to validate input to the \.\pipe\RepairServicepipecompany named pipe, which allows remote authenticated users to execute arbitrary code by...

Windows SMB2 Negotiate Protocol (0x72) Response DOS

Exploit for windows platform in category dos / poc =================================================== Windows SMB2 Negotiate Protocol 0x72 Response DOS =================================================== !/usr/bin/python === EDIT – this exploit appears to be exactly the same one of one which w...

Microsoft Windows SMB2 Negotiate Protocol Response Crash

import socket,sys,time print "Maliformed negotiate protocol response and quickly closing the connection causes Windows machines supporting SMB2 to crash." print "Written by Jelmer de Hen" print "Published at http://h.ackack.net/?p=387" smb = socket.socketsocket.AFINET, socket.SOCKSTREAM smb.bind"...

Microsoft Windows - SMB2 Negotiate Protocol 0x72 Response Denial of Service

Microsoft Windows - SMB2 Negotiate Protocol 0x72 Response Denial of Service !/usr/bin/python === EDIT – this exploit appears to be exactly the same one of one which was already found and fixed notified by Laurent Gaffié, i did not know this but his blog post can be found here:...

Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service

!/usr/bin/python === EDIT – this exploit appears to be exactly the same one of one which was already found and fixed notified by Laurent Gaffié, i did not know this but his blog post can be found here: http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html import...

wireshark: invalid pointer dereference in SMB/SMB2 dissectors

The 1 SMB and 2 SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service crash via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap...

Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference

This module triggers a NULL pointer dereference in the SRV2.SYS kernel driver when processing an SMB2 logoff request before a session has been correctly negotiated, resulting in a BSOD. Effecting Vista SP1/SP2 And possibly Server 2008 SP1/SP2, the flaw was resolved with MS09-050. This module...

openSUSE Security Update : wireshark (wireshark-1900)

This update of wireshark fixes : - CVE-2009-4376: Remote attackers could potentially trigger a buffer overflow in the Daintree SNA file parser. - CVE-2009-4377: Specially crafted packets could cause the SMB and SMB2 dissector to crash wireshark. - CVE-2009-2563: Unspecified vulnerability in the...

Debian DSA-1983-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-4377 A NULL pointer dereference wa...

Mandriva Update for wireshark MDVSA-2010:031 (wireshark)

Check for the Version of wireshark OpenVAS Vulnerability Test Mandriva Update for wireshark MDVSA-2010:031 wireshark Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Mandriva Update for wireshark MDVSA-2010:031 (wireshark)

Check for the Version of wireshark OpenVAS Vulnerability Test Mandriva Update for wireshark MDVSA-2010:031 wireshark Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Mandriva Update for wireshark MDVSA-2010:016 (wireshark)

Check for the Version of wireshark OpenVAS Vulnerability Test Mandriva Update for wireshark MDVSA-2010:016 wireshark Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Wireshark sniffer multiple security vulnerabilities

DoS via SMB and SMB2 packets, buffer overflow on Daintree SNA files parsing...

Mandriva Update for wireshark MDVSA-2010:016 (wireshark)

Check for the Version of wireshark OpenVAS Vulnerability Test Mandriva Update for wireshark MDVSA-2010:016 wireshark Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Null pointer dereference

The 1 SMB and 2 SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service crash via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap...