Software Engineering Institute

Mailslot

A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited to 424 bytes, and can use either the TCP or UDP protocol.

SRVR.SYS

The server driver SRVR.SYS is responsible for handling all Server Message Block (SMB) traffic.

The Problem

A buffer overflow can occur during the processing of mailslot messages.

Note that per Tipping Point, it is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots (mailslots that use UDP) are likely to be affected by this vulnerability.

A remote unauthenticated attacker could execute unauthenitcated arbitrary code with kernel-level privileges.

Upgrade

Apply the patches supplied by Microsoft. See Microsoft Security Bulletin MS06-035 for more details.

Restrict Access

Per Microsoft, restricting access to port 445/tcp to trusted hosts will prevent this vulnerability from being exploited. Note that the Microsoft SMB protocol uses this port.