----------------------- References: [Original Advisory ] Lauren Gaffié http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html ----------------------- Hi all, Just for the records since the vulnerability is not only a DoS as stated initially. Below are the technical details I found while verifying the flaw. * This vulnerability is not only a BSOD flaw. It allows remote code execution. The execution of code is far from being reliable though (at the momment). The flaw is a out-of-bounds indexing. We can fully control the 16 bit value used as index within the function table. ---------------------- srv2.sys (Vista) text:000156B3 loc_156B3: ; CODE XREF: Smb2ValidateProviderCallback(x)+4D5j .text:000156B3 ; Smb2ValidateProviderCallback(x)+4DEj .text:000156B3 movzx eax, word ptr [esi+0Ch]; packet->SBM_Header->Process_ID_High .text:000156B7 mov eax, _ValidateRoutines[eax*4]; BUG - out-of-bounds dereference. .text:000156BE test eax, eax .text:000156C0 jnz short loc_156C9 .text:000156C2 mov eax, 0C0000002h .text:000156C7 jmp short loc_156CC .text:000156C9 ; ————————————————————————— .text:000156C9 .text:000156C9 loc_156C9: ; CODE XREF: Smb2ValidateProviderCallback(x)+4F3j .text:000156C9 push ebx .text:000156CA call eax ; Smb2ValidateNegotiate(x) ; Smb2ValidateNegotiate(x) - KABOOOM!! ----------------------- * The exploit provided by Lauren Gaffié ( the researcher who discovered the flaw ) may or may not work since it is based on dereferencing a non-paged memory page. If the original exploit didn't work, it would probably deferenced a zeroed memory. You can try ProcessIDHigh values > 0x13 since any of these should trigger the flaw. Affected versions: Windows Vista - Windows 7 - Windows server 2008. -*---*- More technical details (english) http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1 Detalles técnicos (castellano) http://blog.48bits.com/?p=510 Regards, Rubén.
