PT-2009-1117 · Microsoft · Windows

Laurent Gaffié · Publicado 2009-09-08 · Atualizado 2026-01-24 · CVE-2009-3103

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to a fixed version

Description The issue is related to an array index error in the SMBv2 protocol implementation, allowing remote attackers to execute arbitrary code or cause a denial of service via a specially crafted NEGOTIATE PROTOCOL REQUEST packet. This can be achieved by including an & (ampersand) character in a Process ID High header field, which triggers an attempted dereference of an out-of-bounds memory location. The vulnerability can also be exploited by sending specially crafted SMB packets to a computer running the Server service, potentially allowing an attacker to take complete control of the system.

Recommendations For Microsoft Windows versions prior to a fixed version, apply the necessary patches or updates to resolve the issue. As a temporary workaround, consider restricting access to the SMBv2 protocol to minimize the risk of exploitation. Avoid using the Process ID High header field in the NEGOTIATE PROTOCOL REQUEST packet until the issue is resolved.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2021-04407

CVE-2009-3103

Produtos afetados

Windows

Referências · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh.rb · Exploit
• 🔥 https://exploit-db.com/exploits/14674 · Exploit
• 🔥 https://exploit-db.com/exploits/12524 · Exploit
• 🔥 http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html · Exploit
• 🔥 https://exploit-db.com/exploits/10005 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html · Exploit
• 🔥 https://exploit-db.com/exploits/9594 · Exploit
• 🔥 https://exploit-db.com/exploits/40280 · Exploit
• 🔥 https://exploit-db.com/exploits/16363 · Exploit
• 🔥 http://exploit-db.com/exploits/9594 · Exploit
• 🔥 http://securityfocus.com/bid/36299 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Nota