CVE-2006-3942
Microsoft Windows NT 4.0, 2000, XP, Server 2003 - Denial of Service via Malformed SMB Transaction String
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-3942.
PoCs published by cocoruder, hdm, including Metasploit module auxiliary/dos/windows/smb/ms06_063_trans.
AI-analyzed exploit summary This exploit targets CVE-2006-1315, a memory corruption vulnerability in Microsoft SRV.SYS via malformed SMB requests. It sends a sequence of crafted SMB packets (Negotiate, Session Setup, Tree Connect, and Trans Request) to trigger the vulnerability, potentially leading to remote code execution.
Description
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
Exploits (3)
This exploit targets CVE-2006-1315, a memory corruption vulnerability in Microsoft SRV.SYS via malformed SMB requests. It sends a sequence of crafted SMB packets (Negotiate, Session Setup, Tree Connect, and Trans Request) to trigger the vulnerability, potentially leading to remote code execution.
This Metasploit module exploits a NULL pointer dereference flaw in the SRV.SYS driver of Windows, causing a denial-of-service (DoS) condition by sending malformed SMB transaction requests. It targets the vulnerability described in MS06-063 and CVE-2006-3942.
This exploit triggers a kernel pool corruption in Microsoft SRV.SYS via a mailslot write function, causing a slow corruption of kernel memory by writing two bytes (\xff\xff) into the response packet. It is a denial-of-service (DoS) exploit that crashes the service by repeatedly sending increasingly large payloads to the mailslot.