PT-2010-1842 · Microsoft · Windows Vista+4

Laurent Gaffiã© · Published 2010-02-10 · Updated 2023-12-07 · CVE-2010-0017

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 versions prior to the fixed version Microsoft Windows 7 versions prior to the fixed version Microsoft Windows Vista versions prior to the fixed version Microsoft Windows Server 2008 versions prior to the fixed version

Description A race condition in the SMB client implementation allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code. An unauthenticated remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. This could result in an elevation of privilege vulnerability, allowing an attacker to run arbitrary code with system-level privileges, install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability could also result in a denial of service, causing the computer to stop responding until restarted.

Recommendations For Microsoft Windows Server 2008 R2, update to a version that includes the fix for this issue. For Microsoft Windows 7, update to a version that includes the fix for this issue. For Microsoft Windows Vista, update to a version that includes the fix for this issue. For Microsoft Windows Server 2008, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the SMB protocol to minimize the risk of exploitation. Avoid using the SMB Negotiate response in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2010-0017

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Server 2008 R2

Windows Vista

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop.rb · Exploit
• 🔥 https://exploit-db.com/exploits/12258 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0017 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-006 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0017 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-040A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8298 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-006 · Note