[Full-disclosure] Microsoft SMB Information Disclosure Vulnerability CVE-2006-1315

[<David_Marcus@xxxxxxxxxx>]

Attached is a description of CVE-2006-1315 SMB Information Disclosure
Vulnerability which was patched in MS06-035.

This vulnerability was discovered by Mike Price and Rafal Wojtczuk of
McAfee(r) Avert(r) Labs.

 <<SMB Information Disclosure Vulnerability.txt>> 

Best regards,

Dave Marcus, B.A., CCNA, MCSE
Security Research and Communications Manager
McAfee(r) Avert(r) Labs
(443) 321-3771 Office
(443) 668-0048 Mobile
McAfee Threat Center
<http://www.mcafee.com/us/threat_center/default.asp> 
McAfee Avert Labs Research Blog <http://www.avertlabs.com/research/blog>



_______________________________________________________________________________

McAfee, Inc.
McAfee® Avert® Labs Security Advisory
Public Release Date: 2006-07-11

SMB Information Disclosure Vulnerability

CVE-2006-1315
_______________________________________________________________________________

?       Synopsis

An information disclosure vulnerability exists in the Server service that could 
allow an attacker to retrieve fragments of memory from an affected host via the 
host?s SMB server. 
_______________________________________________________________________________

?       Vulnerable System or Application

Microsoft Windows 2000
Microsoft Windows XP w/ Service Pack 1
Microsoft Windows XP w/ Service Pack 2
Microsoft Windows Server 2003
Microsoft Windows Server 2003 w/ Service Pack 1

_______________________________________________________________________________

?       Vulnerability Information

This issue is caused by the Server protocol driver?s failure to zero out memory 
before reusing it when constructing SMB response messages. An attacker could 
exploit this vulnerability by sending a specially crafted request that when 
processed would result in a response packet being sent that unintentionally 
contained portions of memory from the target host. Note that this vulnerability 
would not allow an attacker to execute code or to elevate their user rights 
directly. It could be used to produce useful information to try to further 
compromise the affected system.
_______________________________________________________________________________

?       Resolution

Microsoft has released a security bulletin and associated patch for this 
vulnerability:
http://www.microsoft.com/technet/security/Bulletin/MS06-035.mspx 

_______________________________________________________________________________

?       Credits

This vulnerability was discovered by Mike Price and Rafal Wojtczuk of McAfee 
Avert Labs. 
_______________________________________________________________________________

?       Legal Notice

Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the convenience 
of McAfee?s customers, and may be redistributed provided that no fee is charged 
for distribution and that the advisory is not modified in any way. McAfee makes 
no representations or warranties regarding the accuracy of the information 
referenced in this document, or the suitability of that information for your 
purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee, Inc. 
and/or its affiliated companies in the United States and/or other Countries.  
All other registered and unregistered trademarks in this document are the sole 
property of their respective owners.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/