PT-2009-1116 · Microsoft · Smb+1

Published 2009-10-14 · Updated 2023-12-07 · CVE-2009-2532

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to the improper processing of the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service. This is due to errors in code generation management. An unauthenticated remote code execution exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. An attacker who successfully exploits this issue could take complete control of the system.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the Server service to minimize the risk of exploitation. Avoid using the SMBv2 protocol in the affected systems until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2021-04406

CVE-2009-2532

Affected Products

Windows

Smb

References · 9

• 🔥 https://exploit-db.com/exploits/14674 · Exploit
• 🔥 https://exploit-db.com/exploits/40280 · Exploit
• https://bdu.fstec.ru/vul/2021-04406 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2532 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-050 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6336 · Note
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Note