PT-2009-5948 · Microsoft · Windows 7+2

Laurent Gaffié · Published 2009-11-13 · Updated 2018-10-30 · CVE-2009-3676

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 Microsoft Windows 7

Description A denial of service issue exists in the Microsoft Server Message Block (SMB) client implementation, allowing remote SMB servers and man-in-the-middle attackers to cause a system hang via a specially crafted SMB response packet. This can be achieved by sending an SMBv1 or SMBv2 response packet with an incorrect length value in a NetBIOS header or an additional length field at the end of the response packet. An attempt to exploit this issue does not require authentication, and a successful exploitation could cause the computer to stop responding until restarted.

Recommendations For Microsoft Windows Server 2008 R2, apply the necessary patch to fix the SMB client implementation. For Microsoft Windows 7, apply the necessary patch to fix the SMB client implementation. As a temporary workaround, consider restricting access to SMB services until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-3676

Affected Products

Windows 7

Windows Server 2008 R2

Windows

References · 16

• 🔥 http://praetorianprefect.com/archives/2009/11/how-to-crash-windows-7-and-server-2008 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2009/Nov/134 · Exploit
• 🔥 http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3676 · Security Note
• http://microsoft.com/technet/security/advisory/977544.mspx · Vendor Advisory
• http://secunia.com/advisories/37347 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3216 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-020 · Vendor Advisory
• http://secunia.com/blog/66 · Vendor Advisory
• http://blogs.technet.com/msrc/archive/2009/11/13/microsoft-security-advisory-977544-released.aspx · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS10-020 · Note
• http://us-cert.gov/cas/techalerts/TA10-103A.html · Note
• http://securitytracker.com/id?1023179 · Note
• http://news.cnet.com/8301-27080_3-10395891-245.html · Note