SMB: IPC Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Server Message Block (SMB). Attackers can submit malicious SMB packets that can allow them to take complete control of the affected system.

Extended Description

Microsoft SMB is susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer. Remote attackers may exploit this vulnerability to execute arbitrary machine code in the context of the kernel containing the vulnerable code. Microsoft has stated that other attack vectors may exist, in the form of passing malicious parameters to the affected component, either locally or remotely. Failed exploit attempts will likely crash the affected computer, denying service to legitimate users.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 54931 13942 54940

CVE: CVE-2012-1852

URL: http://www.microsoft.com/technet/security/bulletin/ms05-027.mspx http://www.kb.cert.org/vuls/id/489397

Short Name

SMB:OF:SMB-IPC-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: IPC Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?