Microsoft Server Message Block Redirector Driver (mrxsmb.sys)does not verify user-mode buffer properly, allowing to any user to overwrite any desired memory address. The successful exploitation results in Ring0 code execution. + Paper/Advisory: -Reversing mrxsmb.sys. Chapter I "Getting Ring0"-(pdf) + Exploit code (c source code) Both two can be downloaded at www.reversemode.com This issue has been addressed in the recent bulletin, MS06-030 . Ruben Santamarta, www.reversemode.com
