full-disclosure - Repost of Microsoft SMB Information Disclosure Vulnerability CVE-2006-1315

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Jul 12 13:54:07 2006
From: David_Marcus at McAfee.com (David_Marcus@...fee.com)
Subject: Repost of Microsoft SMB Information Disclosure
	Vulnerability CVE-2006-1315

________________________________________________________________________
_______

McAfee, Inc.
McAfee(r) Avert(r) Labs Security Advisory
Public Release Date: 2006-07-11

SMB Information Disclosure Vulnerability

CVE-2006-1315
________________________________________________________________________
_______

*	Synopsis

An information disclosure vulnerability exists in the Server service
that could allow an attacker to retrieve fragments of memory from an
affected host via the host's SMB server.

________________________________________________________________________
_______

*	Vulnerable System or Application

Microsoft Windows 2000
Microsoft Windows XP w/ Service Pack 1
Microsoft Windows XP w/ Service Pack 2
Microsoft Windows Server 2003
Microsoft Windows Server 2003 w/ Service Pack 1

________________________________________________________________________
_______

*	Vulnerability Information

This issue is caused by the Server protocol driver's failure to zero out
memory before reusing it when constructing SMB response messages. An
attacker could exploit this vulnerability by sending a specially crafted
request that when processed would result in a response packet being sent
that unintentionally contained portions of memory from the target host.
Note that this vulnerability would not allow an attacker to execute code
or to elevate their user rights directly. It could be used to produce
useful information to try to further compromise the affected system.
________________________________________________________________________
_______

*	Resolution

Microsoft has released a security bulletin and associated patch for this
vulnerability:
http://www.microsoft.com/technet/security/Bulletin/MS06-035.mspx 

________________________________________________________________________
_______

*	Credits

This vulnerability was discovered by Mike Price and Rafal Wojtczuk of
McAfee Avert Labs. 
________________________________________________________________________
_______

*	Legal Notice

Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the
convenience of McAfee's customers, and may be redistributed provided
that no fee is charged for distribution and that the advisory is not
modified in any way. McAfee makes no representations or warranties
regarding the accuracy of the information referenced in this document,
or the suitability of that information for your purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,
Inc. and/or its affiliated companies in the United States and/or other
Countries.  All other registered and unregistered trademarks in this
document are the sole property of their respective owners.

Best regards,

Dave Marcus, B.A., CCNA, MCSE
Security Research and Communications Manager
McAfee(r) Avert(r) Labs
(443) 321-3771 Office
(443) 668-0048 Mobile
McAfee Threat Center
<http://www.mcafee.com/us/threat_center/default.asp> 
McAfee Avert Labs Research Blog <http://www.avertlabs.com/research/blog>