Microsoft Windows - RRAS RASMAN Registry Stack Overflow (MS06-025) (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

CVE-2006-3281

Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ %2e%2e%5c sequences and whose extension contains the CLSID Key identifier...

CVE-2006-3281

CVE-2006-3281 : A remote code execution flaw in Windows Explorer/Internet Explorer 6 related to handling of Drag & Drop with CLSID extensions (Folder GUID Code Execution). Root cause: improper handling of directories/CLSID extensions can lead to arbitrary code execution when a user visits a craft...

MSRRAS-pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Microsoft Windows RRAS - Remote Stack Overflow (MS06-025) (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Regarding "SMB Invalid Handle Value" - MS06-030. Vulnerability not fixed.

Hi, Just to confirm that Microsoft has not fixed the NtClose/ZwClose DeadLock vulnerability. The bulletin MS06-030 addressed this flaw as "SMB Invalid Handle Value" which is just an euphemism under my point of view. The code added to mrxsmb.sys is just a wrapper in order to avoid the "Invalid...

MS06-025 Microsoft RRAS Service Overflow

This module exploits a stack buffer overflow in the Windows Routing and Remote Access Service. Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well. A valid username and password is required to exploit this flaw on Windows 2000...

Privilege escalation

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHODNEITHER method flag and an arbitrary address, possibly f...

CVE-2006-2374

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service hang by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock,...

CVE-2006-2373

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHODNEITHER method flag and an arbitrary address, possibly f...

CVE-2006-2374

CVE-2006-2374 (SMB Invalid Handle Vulnerability) affects Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier. The issue is a DoS in MRXSMB.SYS caused by a logic/error in MrxSmbCscIoctlCloseForCopyChunk when given a shadow-device file handle, potentially freezing the system (deadlock). T...

CVE-2006-2373

CVE-2006-2373 : A local elevation-of-privilege in the SMB driver MRXSMB.SYS on affected Windows versions (Windows 2000 SP4, XP SP1/SP2, Server 2003 SP1 and earlier). The vulnerability arises from a logic/validation error in MRxSmbCscIoctlOpenForCopyChunk where, when invoked with METHOD_NEITHER, a...

CVE-2006-2374

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service hang by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock,...

Microsoft SMB Driver Local Denial Of Service Vulnerability

Description The Microsoft SMB driver is prone to a local denial-of-service vulnerability. A local attacker can exploit this issue to create processes that cannot be killed in affected operating systems, potentially denying service to legitimate users and other software on affected computers. This...

MS06-030: Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389)

The remote version of Windows contains a version of SMB Server Message Block protocol that is affected by several vulnerabilities. An attacker may exploit these flaws to elevate his privileges and gain control of the remote host. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

Microsoft SMB Driver - Local Denial of Service

Microsoft SMB Driver - Local Denial of Service // source: https://www.securityfocus.com/bid/18357/info The Microsoft SMB driver is prone to a local denial-of-service vulnerability. A local attacker can exploit this issue to create processes that cannot be killed in affected operating systems,...

Microsoft Windows SMB Driver Local Privilege Escalation Vulnerability

Description The Microsoft SMB driver is susceptible to a local privilege-escalation vulnerability. This issue is due to a failure of the affected software to properly bounds-check user-supplied input prior to copying it to insufficiently-sized kernel memory. A local attacker can exploit this issu...

MS06-025: Vulnerability in Routing and Remote Access Could Allow Remote Code Execution (911280) (uncredentialed check)

The remote version of Windows contains a version of RRAS Routing and Remote Access Service that is affected by several memory corruption vulnerabilities. An attacker may exploit these flaws to execute code on the remote service. C Tenable Network Security, Inc. include"compat.inc"; if description...

MS06-031: Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736)

The remote version of Windows contains a version of SMB Server Message Block protocol that is vulnerable to a spoofing attack. An attacker may exploit these flaws to enduce a user to connect to a malicious RPC server. Tenable Network Security, Inc. include"compat.inc"; if description scriptid2169...

Microsoft SMB Driver - Local Denial of Service

// source: https://www.securityfocus.com/bid/18357/info The Microsoft SMB driver is prone to a local denial-of-service vulnerability. A local attacker can exploit this issue to create processes that cannot be killed in affected operating systems, potentially denying service to legitimate users an...