CERT-In Vulnerability Note
CIVN-2007-0151
Remote Code Execution Vulnerability in Microsoft Windows SMBv2 Code Signing
Original Issue Date:December 12, 2007
Severity Rating: MEDIUM
Systems Affected
Microsoft Windows Vista x64 Edition Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise Microsoft Windows Vista Business Microsoft Windows Vista
Overview
A vulnerability has been reported in Microsoft Windows SMBv2 protocol. This vulnerability could be exploited by an attacker to execute arbitrary code and take control of the affected system as in the context of logged in user.
Description
Server Message Block SMB , also known as CIFS Common Internet File System is the file sharing protocol used by default on Windows based computers. Windows includes an SMB client component Client for Microsoft Windows and an SMB server component File and Printer Sharing for Microsoft Windows .
SMBv2 signing is a feature through which all communications using the Server Message Block SMB protocol can be digitally signed at the packet level. Digitally signing the packets enables the recipient of the packets to confirm their point of origination and their authenticity. The vulnerability is exists in Microsoft Windows SMBv2 protocol when handling SMB packets. This vulnerability could be exploited by attackers to execute arbitrary code via malformed SMBv2 packet by modifying the signature of this SMB packet. Successful exploitation of this vulnerability could allow attacker to take control of the vulnerable system
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS07-063
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms07-063.mspx
References
FrSIRT
http://www.frsirt.com/english/advisories/2007/4179
SecurityTracker
http://securitytracker.com/alerts/2007/Dec/1019072.html
SecurityFocus
http://www.securityfocus.com/bid/26777
Secwatch
http://secwatch.org/advisories/1019736/
Secunia
http://secunia.com/advisories/27997/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|