PT-2006-3336 · Microsoft · Windows 2000+3

Redsand · Publicado 2006-07-11 · Atualizado 2018-10-18 · CVE-2006-2372

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4 Microsoft Windows XP SP1 and SP2 Microsoft Windows Server 2003 up to SP1

Description The issue is related to a buffer overflow in the DHCP Client service, allowing remote attackers to execute arbitrary code via a crafted DHCP response. This is a remote code execution vulnerability that could allow an attacker to take complete control of the affected system.

Recommendations For Microsoft Windows 2000 SP4, update to a newer version to mitigate the risk. For Microsoft Windows XP SP1 and SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 up to SP1, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the DHCP Client service until a patch is available.

Exploit

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-2372

Produtos afetados

Windows

Windows 2000

Windows Server 2003

Windows Xp

Referências · 23

• 🔥 https://exploit-db.com/exploits/2054 · Exploit
• http://vupen.com/english/advisories/2006/2754 · Nota
• http://frsirt.com/english/advisories/2006/2754 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0222.html · Nota
• http://us-cert.gov/cas/techalerts/TA06-192A.html · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-036 · Nota
• http://securityfocus.com/bid/18923 · Correção
• http://securityfocus.com/archive/1/archive/1/444631/100/0/threaded · Nota
• http://securityfocus.com/archive/1/archive/1/439675/100/0/threaded · Nota
• http://securityfocus.com/archive/1/444631/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2372 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2372 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-036 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/257164 · Nota
• http://securityreason.com/securityalert/1201 · Nota