CVE-2005-0045 The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via....
HighCVSS 7.5
EPSS 70.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = enterprise | No fix listed |
| Microsoft windows 2003 server | = enterprise_64-bit | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 2003 server | = standard | No fix listed |
| Microsoft windows 2003 server | = web | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows nt | = 4.0-sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp2 | No fix listed |
| Microsoft windows nt | = 4.0-sp3 | No fix listed |
| Microsoft windows nt | = 4.0-sp4 | No fix listed |
| Microsoft windows nt | = 4.0-sp5 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20050209 EEYE: Windows SMB Client Transaction Response Handling Vulnerability mailing-list
- 20050309 Update: MS05-011 EEYE: Windows SMB Client Transaction Response Handling Vulnerability mailing-list
- 20050209 EEYE: Windows SMB Client Transaction Response Handling Vulnerability mailing-list
- VU#652537 patch third-party-advisory us-government-resource
- 12484 vdb-entry
- TA05-039A patch third-party-advisory us-government-resource
- MS05-011 vendor-advisory
- win-smb-code-execution(19089) vdb-entry
- oval:org.mitre.oval:def:1606 signature vdb-entry
- oval:org.mitre.oval:def:1847 signature vdb-entry
- oval:org.mitre.oval:def:1889 signature vdb-entry
- oval:org.mitre.oval:def:4043 signature vdb-entry