CERT-In Vulnerability Note
CIVN-2009-0114
Microsoft Windows SMB 2.0 'srv2.sys' remote code execution vulnerability
Original Issue Date:September 10, 2009
Updated: May 28, 2010
Severity Rating: HIGH
Systems Affected
- Windows Vista SP 2 and prior
- Windows Vista x64 Edition SP 2 and prior
- Windows Server 2008 for 32-bit Systems SP2 and prior
- Windows Server 2008 for 64-bit Systems SP2 and prior
- Windows Server 2008 for Itanium-based Systems SP 2 and prior
Overview
A zero day vulnerability has been reported in Microsoft Server Message Block SMB implementation. Successful exploitation allows an attacker to execute arbitrary code on affected systems with full administrative rights or leads the operating system to stop responding possibly a, B.S.O.D aka Blue Screen of Death and restart, without any authentication.
Description
Microsoft Server Message Block SMB is a Microsoft network file sharing protocol used in Microsoft Windows and SMB 2.0 has been introduced since Windows Vista. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and its used to identify the SMB dialect that will be used for further communication.
The vulnerability is due to an array index error in the kernel driver srv2.sys which allows remote attackers to cause a denial of service system crash via an & ampersand character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet . which triggers an attempted dereference of an out-of-bounds memory location.
Successful exploitation leads code execution with SYSTEM-level privileges and failed exploit attempts will leads to denial-of-service conditions.
Workaround
- Disable SMB v2
- Block TCP ports 139, 445 at the firewall
For detailed steps and impact of applying these workarounds refer to Microsoft security Advisory 975497
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS09-050
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS09-001.mspx
References
Micorsoft
http://www.microsoft.com/technet/security/bulletin/MS09-001.mspx
http://msdn.microsoft.com/en-us/library/aa365233
http://www.microsoft.com/security/pypc.aspx
ISC SANS
http://isc.sans.org/diary.html?storyid=7093
SecurityFocus
http://www.securityfocus.com/bid/36299
Secunia
http://en.securitylab.ru/bitrix/redirect.php?event3=384948&goto=http 3A 2F 2Fsecunia.com 2Fadvisories 2F36623
Security Tracker
http://securitytracker.com/alerts/2009/Sep/1022848.html
VUPEN
http://www.vupen.com/english/advisories/2009/2561
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=19000
CVE Name
CVE-2009-3103
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|