bugtraq - Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 14 Aug 2006 09:44:07 -0700
From: "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>
To: public@...nk4dd.com, bugtraq@...urityfocus.com
Subject: Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption
 Vulnerability

There's still an unpatched DOS for the server service as blogged on the 
MSRC blog:

Also - an additional point of clarification - its important to 
distinguish that while MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20> 
addresses a vulnerability in the Server Service it does not resolve the 
Denial of Service issue I spoke about earlier on the blog in the 
"Information About Public Postings Related to MS06-035 
<http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx>" posting. 
We are still working on the security update for the Denial of Service 
issue and the report for it came in after we had completed our testing 
cycle for MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>. 
With the importance and potential severity previously 
mentioned regarding MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>we 
felt it was important to get the security update for MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>out 
as soon as possible. We'll continue working on the DoS issue and will 
release a security update once it's reached an appropriate level of quality.

public@...nk4dd.com wrote:
> After furiously patching since last week for catching up with MS06-040, we discovered that a old exploit for MS06-035 (again or still) works on a number fully patched systems including Windows 2003 Server, Windows XP and Windows 2000.
>
> The exploit that works is: http://milw0rm.org/exploits/2057
>
> All our tested systems (8 total) except one went into reboot after being hit with the exploit above. All tested systems have been patched with the latest available patches from Microsoft as of today, August 14th, 2006 4:00 PM MESZ, using both the standard Windows Update function and applying patches by hand.
> Explicit download of KB917159 patch, applying it and reboot, with no result. I carefully checked the version of the srv.sys binary according to http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx and found it to be correct, meaning the patch should be applied correctly.
>
> My only conclusion at this time is that the Microsoft delivered patch for MS06-035 does not work. Can anyone confirm this behaviour?
>
> Thanks,
> Frank
>
> This is regarding MS06-035, CVE-2006-1314
>
>   

-- 
Letting your vendors set your risk analysis these days?  
http://www.threatcode.com

If you are a SBSer and you don't subscribe to the SBS Blog... man ... I will hunt you down...
http://blogs.technet.com/sbs