CVE-2009-3103 Scanner
Detects 'Remote Code Execution (RCE)' vulnerability in SMBv2 affects v. Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7.
Short Info
Level
Critical
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
15 seconds
Time Interval
30 days
Scan only one
Domain, IPv4
Toolbox
-
The SMBv2 protocol is a product used in Microsoft Windows Vista, Windows Server 2008, and Windows 7 RC for file and printer sharing. This protocol allows users to access remote resources on a network and exchange data between devices securely. The SMBv2 protocol is widely used, and it has become an essential part of modern computer networks.
However, the SMBv2 protocol has a vulnerability known as CVE-2009-3103, which can lead to serious security threats. This vulnerability occurs in the srv2.sys implementation of the SMBv2 protocol, allowing remote attackers to execute arbitrary code or cause a denial of service attack. The vulnerability is triggered by an ampersand character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which causes an attempted dereference of an out-of-bounds memory location.
If the SMBv2 vulnerability is exploited, it may lead to the execution of arbitrary code or a system crash. An attacker could use this vulnerability to infiltrate a targeted network, gain unauthorized access to sensitive data, or cause service outages. This vulnerability is a serious risk to organizations and individuals using computers running the affected Windows operating systems.
In conclusion, the SMBv2 Negotiation Vulnerability poses a serious threat to computer networks running Windows Vista, Windows Server 2008, and Windows 7 RC. However, with the pro features of the s4e.io platform, users can easily and quickly learn about vulnerabilities in their digital assets and take necessary steps to protect against them. Taking proactive measures and staying updated on security threats is essential to maintaining the safety and integrity of digital assets.
REFERENCES
- securityfocus.com: 36299
- kb.cert.org: VU#135940
- http://www.microsoft.com/technet/security/advisory/975497.mspx
- http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1
- http://blog.48bits.com/?p=510
- docs.microsoft.com: MS09-050
- us-cert.gov: TA09-286A
- http://isc.sans.org/diary.html?storyid=7093
- secunia.com: 36623
- http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html
- securitytracker.com: 1022848
- securityfocus.com: 20090909 SMB SRV2.SYS Denial of Service PoC
- exploit-db.com: 9594
- archives.neohapsis.com: 20090907 Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
- osvdb.org: 57799
- exchange.xforce.ibmcloud.com: win-srv2sys-code-execution(53090)
- securityfocus.com: 20090908 Regarding Microsoft srv2.sys SMB2.0 NEGOTIATE BSOD
- oval.cisecurity.org: oval:org.mitre.oval:def:6489
