PT-2011-3003 · Microsoft · Windows Vista+3

Publicado 2011-06-16 · Atualizado 2020-09-28 · CVE-2011-1267

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through R2 SP1 Microsoft Windows 7 versions Gold through SP1

Description A denial of service issue exists due to the way the Server Message Block (SMB) Protocol software handles specially crafted requests. This can be exploited by sending a crafted SMBv1 or SMBv2 request, allowing remote attackers to cause a system hang. The vulnerability can be exploited without authentication by sending a specially crafted network message to a computer running the Server service.

Recommendations For Microsoft Windows Vista versions SP1 through SP2, apply the necessary patch to fix the SMB Request Parsing issue. For Microsoft Windows Server 2008 versions Gold through R2 SP1, apply the necessary patch to fix the SMB Request Parsing issue. For Microsoft Windows 7 versions Gold through SP1, apply the necessary patch to fix the SMB Request Parsing issue. As a temporary workaround, consider restricting access to the SMB server to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2011-1267

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Vista

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/67724 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1267 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1267 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-048 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12654 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-048 · Nota