Microsoft Windows contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when a malicious user sends a specially crafted NEGOTIATE PROTOCOL REQUEST SMBv2 packet with an & (ampersand) character in a Process ID High header field, causing an attempted dereference of an out-of-bounds memory location. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft Corporation has released a patch to address this vulnerability.

• Exploit Database: 10005 12524 9594
• CVE ID: 2009-3103 (see also: NVD)
• Bugtraq ID: 36299
• Secunia Advisory ID: 36623
• SCIP VulDB ID: 4031
• Metasploit ID: 57799
• Related OSVDB ID: 58875 58876
• Milw0rm: 9594
• Microsoft Knowledge Base Article: 975497
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-09/0043.html
  http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html
  http://seclists.org/fulldisclosure/2009/Sep/0039.html
• Other Advisory URL: http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html
  http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html
  http://isc.sans.org/diary.html?storyid=7093
  http://threatpost.com/blogs/new-remote-flaw-found-smb2-windows-vista-and-windows-7-108
• Vendor Specific Solution URL: http://blogs.technet.com/srd/archive/2009/09/18/update-on-the-smb-vulnerability.aspx
• Generic Exploit URL: http://immunitysec.com
  http://www.saintcorporation.com/cgi-bin/exploit_info/windows_smb2
  https://www.immunityinc.com/downloads/immpartners/smb2_negotiate_remote.tgz [ Auth Req'd ]
• News Article: http://legacy.macnn.com/articles/09/09/08/windows.7.returns.remote.bsod/
  http://www.computerworld.com/s/article/9137731/Unpatched_Microsoft_bugs_raise_red_flags?taxonomyId=17
  http://www.scmagazineus.com/Researchers-fret-over-new-Microsoft-SMB-vulnerability/article/148448/
  http://www.theregister.co.uk/2009/09/09/microsoft_windows_security_bug/
  http://www.theregister.co.uk/2009/09/16/windows_vista_exploit_released/
• Packet Storm: http://www.packetstormsecurity.org/0909-exploits/smb2_negotiate_func_index.rb.txt
• Microsoft Security Bulletin: MS09-050

• Matthieu Suiche - Netherlands Forensics Institute