Buffer overflow in Microsoft Windows and Windows Server - CVE-2006-3439

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Microsoft Windows Server Service. A remote attacker can send a specially crafted packet to port 139/TCP or 445/TCP, trigger boundary error and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Affected software

How to mitigate CVE-2006-3439

• Microsoft Windows 2000 Service Pack 4 — Download the update
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 — Download the update
• Microsoft Windows XP Professional x64 Edition — Download the update
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 — Download the update
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems — Download the update
• Microsoft Windows Server 2003 x64 Edition — Download the update

Links to Public Exploits and PoC-codes

• Exploit #498 - Microsoft Server Service - NetpwPathCanonicalize Overflow (MS06-040) (Metasploit) (March 18, 2020)
• Exploit #499 - Microsoft Windows Server 2003 - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) (March 18, 2020)
• Exploit #500 - Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (2) (March 18, 2020)
• Exploit #501 - Microsoft Windows - CanonicalizePathName() Remote Exploit (MS06-040) (March 18, 2020)
• Exploit #502 - Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) (March 18, 2020)
• Exploit #1598 - MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow (March 18, 2020)

External References

• https://technet.microsoft.com/en-us/library/security/ms06-040.aspx

Related Security Bulletins

• Buffer overflow in Microsoft Windows Server service