Microsoft Windows SMB/CIFS privilege escalation updated since 13.06.2006
Published:		16.06.2006
Source:		BUGTRAQ
SecurityVulns ID:		6258
Type:		local
Level:		6/10
Description:		MRxSmbCscIoctlOpenForCopyChunk buffer overflow. In additions, there are DoS vulnerabilities not covered by MS06-30.

Affected:		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows 2000 Professional
		MICROSOFT : Windows XP
		MICROSOFT : Windows 2003 Server

Original document		Reversemode, Regarding "SMB Invalid Handle Value" - MS06-030. Vulnerability not fixed. (16.06.2006)
		ruben_(at)_reversemode.com, REVERSING MRXSMB.SYS CHAPTER I “Getting Ring0” (14.06.2006)
		ruben_(at)_reversemode.com, REVERSING MRXSMB.SYS CHAPTER II “NtClose DeadLock” (14.06.2006)
		IDEFENSE, iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS (14.06.2006)
		IDEFENSE, iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MRxSmbCscIoctlOpenForCopyChunk Overflow (14.06.2006)
		MICROSOFT, Microsoft Security Bulletin MS06-030 Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389) (13.06.2006)

Files:		Exploit for the Mrxsmb.sys privilege escalation(MS06-030), which allows to execute ring0 shellcode. "Fast-Food" coding style, nasty but works. C source code.
		Exploit for the NtClose DeadLock vulnerability (MS06-030). C source code.
		http://www.microsoft.com/technet/security/Bulletin/MS06-030.mspx
Discuss:		Read or add your comments to this news (0 comments)