PT-2009-1117 · Microsoft · Windows

Laurent Gaffié · Published 2009-09-08 · Updated 2026-01-24 · CVE-2009-3103

Positive Technologies · (AI Summary)

CVSS v2.0

10

High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to a fixed version

Description The issue is related to an array index error in the SMBv2 protocol implementation, allowing remote attackers to execute arbitrary code or cause a denial of service via a specially crafted NEGOTIATE PROTOCOL REQUEST packet. This can be achieved by including an & (ampersand) character in a Process ID High header field, which triggers an attempted dereference of an out-of-bounds memory location. The vulnerability can also be exploited by sending specially crafted SMB packets to a computer running the Server service, potentially allowing an attacker to take complete control of the system.

Recommendations For Microsoft Windows versions prior to a fixed version, apply the necessary patches or updates to resolve the issue. As a temporary workaround, consider restricting access to the SMBv2 protocol to minimize the risk of exploitation. Avoid using the Process ID High header field in the NEGOTIATE PROTOCOL REQUEST packet until the issue is resolved.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2021-04407

CVE-2009-3103

Affected Products

Windows

References · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh.rb · Exploit
• 🔥 https://exploit-db.com/exploits/14674 · Exploit
• 🔥 https://exploit-db.com/exploits/12524 · Exploit
• 🔥 http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html · Exploit
• 🔥 https://exploit-db.com/exploits/10005 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html · Exploit
• 🔥 https://exploit-db.com/exploits/9594 · Exploit
• 🔥 https://exploit-db.com/exploits/40280 · Exploit
• 🔥 https://exploit-db.com/exploits/16363 · Exploit
• 🔥 http://exploit-db.com/exploits/9594 · Exploit
• 🔥 http://securityfocus.com/bid/36299 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 · Security Note