| ID |
CVE-2009-3676
|
| Summary |
The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service (infinite loop and system hang) via a (1) SMBv1 or (2) SMBv2 response packet that contains (a) an incorrect length value in a NetBIOS header or (b) an additional length field at the end of this response packet, aka "SMB Client Incomplete Response Vulnerability." |
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | 7.1 (as of 30-10-2018 - 16:28) |
| Impact: | |
| Exploitability: | |
|
| CWE |
CWE-399 |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
NONE |
COMPLETE |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:N/I:N/A:C
|
| msbulletin
via4
|
| bulletin_id | MS10-020 | | bulletin_url | | | date | 2010-04-13T00:00:00 | | impact | Remote Code Execution | | knowledgebase_id | 980232 | | knowledgebase_url | | | severity | Critical | | title | Vulnerabilities in SMB Client Could Allow Remote Code Execution |
|
| oval
via4
|
| accepted | 2012-03-26T04:03:48.828-04:00 | | class | vulnerability | | contributors | | name | Dragos Prisaca | | organization | Symantec Corporation |
| name | Dragos Prisaca | | organization | Symantec Corporation |
| | definition_extensions | | comment | Microsoft Windows 7 (32-bit) is installed | | oval | oval:org.mitre.oval:def:6165 |
| comment | Microsoft Windows 7 x64 Edition is installed | | oval | oval:org.mitre.oval:def:5950 |
| comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | | oval | oval:org.mitre.oval:def:6438 |
| comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | | oval | oval:org.mitre.oval:def:5954 |
| comment | Microsoft Windows 7 (32-bit) is installed | | oval | oval:org.mitre.oval:def:6165 |
| comment | Microsoft Windows 7 x64 Edition is installed | | oval | oval:org.mitre.oval:def:5950 |
| comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | | oval | oval:org.mitre.oval:def:6438 |
| comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | | oval | oval:org.mitre.oval:def:5954 |
| | description | The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service (infinite loop and system hang) via a (1) SMBv1 or (2) SMBv2 response packet that contains (a) an incorrect length value in a NetBIOS header or (b) an additional length field at the end of this response packet, aka "SMB Client Incomplete Response Vulnerability." | | family | windows | | id | oval:org.mitre.oval:def:7186 | | status | accepted | | submitted | 2010-03-13T13:00:00 | | title | SMB Client Incomplete Response Vulnerability | | version | 48 |
|
| refmap
via4
|
| cert | TA10-103A | | confirm | | | fulldisc | 20091111 Windows 7 , Server 2008R2 Remote Kernel Crash | | misc | | | sectrack | 1023179 | | secunia | 37347 | | vupen | ADV-2009-3216 |
|
| Last major update |
30-10-2018 - 16:28 |
| Published |
13-11-2009 - 15:30 |
| Last modified |
30-10-2018 - 16:28 |
