Stack overflow

Stack consumption vulnerability in the SMB Server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to cause a denial of service system hang via a malformed SMBv2 compounded request, aka "SMB Stack Exhaustion Vulnerability."...

CVE-2010-2552

CVE-2010-2552 is the SMB Stack Exhaustion vulnerability in the SMB Server of affected Windows platforms. It occurs when the SMBv2 compounded requests are malformed, causing a denial-of-service (system hang). Affected products per sources include Windows Vista SP1/SP2, Windows Server 2008 (Gold/SP...

Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit)

$Id: ms09050smb2negotiatefuncindex.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2010-0270

The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate fields in SMB transaction responses, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and reboot via a crafted 1 SMBv...

CVE-2010-0476

The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and reboot via a crafted SMB transaction response...

Memory corruption

The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate fields in SMB transaction responses, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and reboot via a crafted 1 SMBv...

Memory corruption

The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly allocate memory for SMB responses, which allows remote SMB servers and man-in-the-middle attacker...

CVE-2010-0269

CVE-2010-0269 is a remote code execution vulnerability in the Microsoft SMB client. The issue arises from improper memory allocation when parsing specially crafted SMB responses, enabling an unauthenticated attacker to execute arbitrary code on a vulnerable system by sending a crafted SMB respons...

CVE-2010-0477

CVE-2010-0477 is a remote code execution vulnerability in the Microsoft SMB client. The SMB client in Windows 7 and Windows Server 2008 R2 can be tricked by specially crafted SMB responses (affecting both SMBv1 and SMBv2), allowing an unauthenticated remote attacker to execute arbitrary code on t...

Race condition

Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow remote attackers to cause a denial of service system hang via a crafted 1 SMBv1 or 2 SMBv2 Negotiate packet, aka "SMB...

CVE-2010-0021

Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow remote attackers to cause a denial of service system hang via a crafted 1 SMBv1 or 2 SMBv2 Negotiate packet, aka "SMB...

CVE-2009-3676

The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service infinite loop and system hang via a 1 SMBv1 or 2 SMBv2 response packet that contains a an incorrect length value in a NetBIOS heade...

smbv2-enabled NSE Script

Checks whether or not a server is running the SMBv2 protocol. Script Arguments randomseed, smbbasic, smbport, smbsign See the documentation for the smb library. smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername See the documentation for the smbauth library. Example Usage nmap...

Microsoft Blames Human Error For Critical SMB2 Vulnerability

Microsoft is blaming human error for the the critical SMB v2 vulnerability that exposed Windows users to remote code execution attacks and argues that it’s near impossible to catch these types of bugs with existing code review tools and techniques. According to a post-mortem of the issue by Redmo...

Microsoft Windows SMB2 Negotiation Protocol RCE Vulnerability

This host is missing a critical security update according to Microsoft Bulletin MS09-050. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2009-2526

Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service infinite loop and system hang via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."...

CVE-2009-2532

Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service, aka...

Design/Logic Flaw

Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service, aka...

Code injection

Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service infinite loop and system hang via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."...

CVE-2009-2532

CVE-2009-2532 refers to a remote-code-execution vulnerability in the SMBv2 implementation of Windows SMB Server. The issue arises from how SMBv2 handles the command value in SMB Multi-Protocol Negotiate packets, allowing an unauthenticated attacker to execute arbitrary code on affected systems. A...