• 공개일 : 2009-09-09
• 변경일 : 2011-06-24

• 위험도: 10.0
• 액세스 벡터 : NETWORK
• 액세스 복잡성 : 낮음
• 인증 : 없음
• 기밀성 영향 : 전체
• 무결성 영향 : 전체
• 가용성 영향 : 전체
• 출처 : http://nvd.nist.gov
• 공개일 : 2009-09-10

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

• CERT, TA09-286A
• CERT-VN, VU#135940
• MS, MS09-050
• XF, win-srv2sys-code-execution(53090)
• SECTRACK, 1022848
• BID, 36299
• BUGTRAQ, 20090909 SMB SRV2.SYS Denial of Service PoC
• BUGTRAQ, 20090908 Regarding Microsoft srv2.sys SMB2.0 NEGOTIATE BSOD
• MISC, http://www.reversemode.com/index.php?option=com_content&task=view&id=64&..
• MILW0RM, 9594
• CONFIRM, http://www.microsoft.com/technet/security/advisory/975497.mspx
• SECUNIA, 36623
• OSVDB, 57799
• MISC, http://isc.sans.org/diary.html?storyid=7093
• MISC, http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-pro..
• MISC, http://blog.48bits.com/?p=510
• FULLDISC, 20090907 Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote ..

• microsoft windows_server_2008
• microsoft windows_vista x64
• microsoft windows_server_2008 itanium
• microsoft windows_server_2008 itanium
• microsoft windows_server_2008 sp2
• microsoft windows_server_2008 x64
• microsoft windows_server_2008 sp2
• microsoft windows_vista
• microsoft windows_vista x64
• microsoft windows_server_2008 x32
• microsoft windows_vista
• microsoft windows_vista