PT-2008-5415 · Microsoft · Server Service+2

Javier Vicente Vallejo · Published 2008-09-16 · Updated 2023-12-07 · CVE-2008-4114

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008

Description A denial of service issue exists due to insufficient validation of buffer sizes in the Server service, allowing remote attackers to cause a system crash or possibly have other impacts via an SMB WRITE ANDX packet with an inconsistent offset and packet size. This can be demonstrated by a request to the PIPElsarpc named pipe. An attacker can exploit this issue by sending a specially crafted network message to a computer running the Server service, potentially causing the computer to stop responding and restart.

Recommendations For Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, consider applying configuration changes to restrict access to the Server service until a patch is available. As a temporary workaround, consider disabling the srv.sys driver in the Server service to minimize the risk of exploitation. Restrict access to the PIPElsarpc named pipe to prevent potential attacks via specially crafted SMB packets.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4114

Affected Products

Windows

Server Service

Srv.Sys

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms09_001_write.rb · Exploit
• 🔥 http://vallejo.cc/proyectos/vista_SMB_write_DoS.htm · Exploit
• 🔥 http://securityfocus.com/bid/31179 · Exploit
• 🔥 http://reversemode.com/index.php?option=com_content&task=view&id=54&Itemid=1 · Exploit
• 🔥 https://exploit-db.com/exploits/6463 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4114 · Security Note
• http://secunia.com/advisories/31883 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-001 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4114 · Security Note
• http://vupen.com/english/advisories/2008/2583 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA09-013A.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45146 · Note
• http://securityfocus.com/archive/1/496354/100/0/threaded · Note
• http://securitytracker.com/id?1020887 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5262 · Note