PT-2010-1842 · Microsoft · Windows Vista+4

Laurent Gaffiã© · Publicado 2010-02-10 · Atualizado 2023-12-07 · CVE-2010-0017

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 versions prior to the fixed version Microsoft Windows 7 versions prior to the fixed version Microsoft Windows Vista versions prior to the fixed version Microsoft Windows Server 2008 versions prior to the fixed version

Description A race condition in the SMB client implementation allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code. An unauthenticated remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. This could result in an elevation of privilege vulnerability, allowing an attacker to run arbitrary code with system-level privileges, install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability could also result in a denial of service, causing the computer to stop responding until restarted.

Recommendations For Microsoft Windows Server 2008 R2, update to a version that includes the fix for this issue. For Microsoft Windows 7, update to a version that includes the fix for this issue. For Microsoft Windows Vista, update to a version that includes the fix for this issue. For Microsoft Windows Server 2008, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the SMB protocol to minimize the risk of exploitation. Avoid using the SMB Negotiate response in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

DoS

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2010-0017

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Server 2008 R2

Windows Vista

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop.rb · Exploit
• 🔥 https://exploit-db.com/exploits/12258 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0017 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-006 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA10-040A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8298 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-006 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0017 · Nota de Segurança