Overview
Microsoft Server Message Block (SMB) may crash upon receipt of a crafted SMB_COM_TRANSACTION packet requesting a NetServerEnum3 transaction. Attackers can use this vulnerability to cause a denial of service.
Description
SMB is a protocol for sharing data and resources between computers, included in many versions of Microsoft Windows. SMB may crash if it receives a crafted SMB_COM_TRANSACTION packet requesting a NetServerEnum2 transaction. If either the 'Max Param Count' field or 'Max Data Count' field of the packet is set to zero (0), the destination SMB host will crash with a blue screen. This vulnerability can be exploited by both local and remote attackers. |
Impact
Remote attackers can cause a denial of service. Attackers may also be able to execute arbitrary code, though this has not been demonstrated or proven. |
Solution
Apply a patch |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Ivan Arce of CORE Security Technologies for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | None |
| Severity Metric: | 0.87 |
| Date Public: | 2002-08-22 |
| Date First Published: | 2002-08-23 |
| Date Last Updated: | 2002-08-26 18:22 UTC |
| Document Revision: | 10 |