|
Thursday, 22 April 2010 01:27 |
On Tuesday, April 13th, Microsoft released security update MS10-020 - Vulnerabilities in SMB Client Could Allow Remote Code Execution (980232) This security update resolves one publicly disclosed and several privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request. To exploit these vulnerabilities, an attacker must convince the user to initiate an SMB connection to a specially crafted SMB server. Microsoft ratings for MS10-020: Maximum Severity Rating - Critical Impact of Vulnerability - Remote Code Execution SMB Client Incomplete Response Vulnerability - CVE-2009-3676 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3676 A denial of service vulnerability exists in the way that the Microsoft Server Message Block (SMB) client implementation handles specially crafted SMB responses. An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted SMB response to a client-initiated SMB request. An attacker who successfully exploited this vulnerability could cause the computer to stop responding until restarted. SMB Client Memory Allocation Vulnerability - CVE-2010-0269 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0269 An unauthenticated remote code execution vulnerability exists in the way that the Microsoft Server Message Block (SMB) client implementation allocates memory when parsing specially crafted SMB responses. An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted SMB response to a client-initiated SMB request. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, o
Source : http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=1004295&poid=
|
News 
