Microsoft Windows SMB pool code execution (SMB_Trans2_QueryFS_Exec)

About this signature or vulnerability

IBM Security Server Protection for Windows, Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, RealSecure Network, RealSecure Server Sensor, Proventia Desktop, Proventia Network IPS, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware:

This signature looks for a malformed SMB Transact2 message that can lead to remote code execution.


Default risk level

High risk vulnerability  High

Sensors that have this signature

IBM Security Server Protection for Windows: 2.1.14.2550, Proventia Network MFS: XPU 30.080, Proventia-G 1.1 and earlier: XPU 30.080, Proventia Network IDS: XPU 30.080, RealSecure Network: XPU 30.080, RealSecure Server Sensor: XPU 30.080, Proventia Desktop: 2550, Proventia Network IPS: XPU 30.080, Proventia Server IPS for Linux technology: 30.080, Virtual Server Protection for Vmware: XPU 30.080

Systems affected

Microsoft Windows Server 2003: SP2, Microsoft Windows Server 2003: SP2 Itanium, Microsoft Windows Server 2003: SP2 x64, Microsoft Windows XP: SP2 x64 Professional, Microsoft Windows Vista: SP1, Microsoft Windows Vista: SP1 x64, Microsoft Windows Server 2008: Itanium, Microsoft Windows Server 2008: x32, Microsoft Windows Server 2008: x64, Microsoft Windows XP: SP3, Microsoft Windows Vista: SP2 x64, Microsoft Windows Vista: SP2, Microsoft Windows Server 2008: SP2 x32, Microsoft Windows Server 2008: SP2 x64, Microsoft Windows 7: x64, Microsoft Windows 7: x32, Microsoft Windows Server 2008: R2 x64, Microsoft Windows Server 2008: R2 Itanium, Microsoft Windows Server 2008: SP2 Itanium

Type

Unauthorized Access Attempt

Vulnerability description

Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by an error related to an SMB pool overflow when handling malicious SMB packets by the Microsoft Server Message Block (SMB) Protocol software. By sending a specially-crafted SMB packet, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with elevated privileges.

How to remove this vulnerability

Apply the appropriate patch for your system, as listed in the latest Microsoft Security Bulletin. See References.

— OR —

Use Microsoft Automatic Update if it is supported by your operating system. The original bulletin issued by Microsoft has been superseded.

References

Microsoft Security Bulletin MS10-054
Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214)
http://www.microsoft.com/technet/security/bulletin/ms10-054.mspx

IBM Internet Security Systems Protection Alert
Microsoft Windows SMB Server Remote Code Execution
http://www.iss.net/threats/374.html

Offensive Security Exploit Database [08-10-2010]
Microsoft SMB Server Trans2 Zero Size Pool Alloc (MS10-054)
http://www.exploit-db.com/exploits/14607/

Microsoft Security Bulletin MS11-020
Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
http://www.microsoft.com/technet/security/bulletin/ms11-020.mspx

ISS X-Force
Microsoft Windows SMB pool code execution
http://www.iss.net/security_center/static/60689.php

CVE
CVE-2010-2550
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2550