SMB: SMB Server Copy Operation Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Windows SMB server. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the system.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that affects the Microsoft Server Message Block (SMB) protocol software. An authenticated attacker can exploit this issue to execute code with SYSTEM-level privileges. Failed exploit attempts will likely cause denial-of-service conditions.

Affected Products

Microsoft windows_vista_business_64-bit_edition

References

BugTraq: 38049

CVE: CVE-2010-0020

URL: http://www.microsoft.com/technet/security/Bulletin/MS10-012.mspx

Short Name

SMB:SMB-COPY-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: SMB Server Copy Operation Overflow

Extended Description

Affected Products

References

Found a potential security threat?