OSVDB ID: 26440

Title: Microsoft Windows SMB MrxSmbCscIoctlOpenForCopyChunk Function Overflow

Info

Disclosure
Jun 13, 2006

Discovery
Unknown

Dates

Exploit
Jun 13, 2006

Solution
Unknown

Description

 A local overflow exists in Microsoft SMB. The function 'MrxSmbCscIoctlOpenForCopyChunk' fails to validate input when handling certain DeviceIoControl requests resulting in an overflow. With a specially crafted request, an attacker can execute arbitrary code with escalated privileges resulting in a loss of integrity.

Classification

 Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 2003 Server SP1
XP SP2
XP SP1
2000 SP4

References

Credit
  • Ruben Santamarta - advisoriesreversemode.com -


Direct URL: http://osvdb.org/26440