SMB: SMB Search Context Remote Buffer Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft SMB. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the kernel.

Extended Description

Microsoft Windows is prone to a remote code execution vulnerability caused by a buffer-underflow condition in the SMB (Server Message Block) protocol implementation. To exploit the issue, an attacker must first successfully authenticate as a legitimate user or a Guest user on the affected computer. A successful exploit will completely compromise the affected computer.

Affected Products

Microsoft windows_server_2008_for_itanium-based_systems

References

BugTraq: 31647

CVE: CVE-2008-4038

Short Name

SMB:SEARCH-OF

Severity

Major

Recommended

False

Recommended Action

Drop

SMB: SMB Search Context Remote Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?