Vulnerability Details : CVE-2006-3942
Public exploit exists!
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2006-3942
Probability of exploitation activity in the next 30 days: 97.00%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2006-3942
-
Microsoft SRV.SYS Pipe Transaction No Null
First seen: 2020-04-26auxiliary/dos/windows/smb/ms06_063_transThis module exploits a NULL pointer dereference flaw in the SRV.SYS driver of the Windows operating system. This bug was independently discovered by CORE Security and ISS. Authors: - hdm <x@hdm.io> -
Microsoft SRV.SYS Mailslot Write Corruption
Disclosure Date: 2006-07-11First seen: 2020-04-26auxiliary/dos/windows/smb/ms06_035_mailslotThis module triggers a kernel pool corruption bug in SRV.SYS. Each call to the mailslot write function results in a two byte return value being written into the response packet. The code which creates this packet fails to consider these two bytes in the allocation routine,
CVSS scores for CVE-2006-3942
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2006-3942
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2006-3942
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A428
-
http://www.securityfocus.com/archive/1/443287/100/200/threaded
-
http://www.vupen.com/english/advisories/2006/3037
Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-063
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://securitytracker.com/id?1017035
-
http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx
-
http://xforce.iss.net/xforce/alerts/id/231
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/27999
-
http://www.coresecurity.com/common/showdoc.php?idx=562&idxseccion=10
404 Page | Core Security
-
http://securitytracker.com/id?1016606
-
http://www.securityfocus.com/bid/19215
Microsoft Windows SMB PIPE Remote Denial of Service Vulnerability
Products affected by CVE-2006-3942
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:64-bit:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:itanium:*:*:*:*:*:*:*