PT-2006-3299 · Microsoft · Windows 2000+2

Publicado 2006-05-12 · Atualizado 2018-10-18 · CVE-2006-2334

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 2000 SP4 and XP SP2

Description The issue concerns the RtlDosPathNameToNtPathName U API function in NTDLL.DLL, which fails to properly convert DOS style paths with trailing spaces into NT style paths. This allows attackers to create files that cannot be accessed through the expected DOS path or prevent access to other similarly named files in the same directory. As a result, certain anti-virus and anti-spyware software may be unable to detect or disinfect these files.

Recommendations For Microsoft Windows 2000 SP4 and XP SP2, consider applying configuration changes to handle DOS style paths with trailing spaces correctly until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-2334

Produtos afetados

Ntdll.Dll

Windows 2000

Windows Xp

Referências · 7

• 🔥 https://exploit-db.com/exploits/27851 · Exploit
• 🔥 http://48bits.com/advisories/rtldospath.pdf · Exploit
• 🔥 http://securityfocus.com/bid/17934 · Exploit
• http://securityfocus.com/archive/1/433583/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2334 · Nota de Segurança
• http://osvdb.org/25761 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26487 · Nota