National Vulnerability Database (CVE-2006-3439)

National Cyber-Alert System Vulnerability Summary: CVE-2006-3439
Orirignal release date: 2006-08-08 Source: US-CERT/NIST ### Overview Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314. ### Impact CVSS Severity: 10.0 (High) Range: remote Authentication: input buffer="1" Impact Type: avail,conf,int,sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: MS Name: MS06-040 Hyperlink: http://www.microsoft.com/technet/security/bulletin/ms06-040.mspx External Source: CERT Name: TA06-220A Hyperlink: http://www.us-cert.gov/cas/techalerts/TA06-220A.html External Source: CERT-VN Name: VU#650769 Hyperlink: http://www.kb.cert.org/vuls/id/650769 External Source: FRSIRT Name: ADV-2006-3210 Hyperlink: http://www.frsirt.com/english/advisories/2006/3210 External Source: SECUNIA Name: 21388 Hyperlink: http://secunia.com/advisories/21388 External Source: NSO Name: http://www.dhs.gov/dhspublic/display?content=5789 Hyperlink: http://www.dhs.gov/dhspublic/display?content=5789 External Source: BID Name: 19409 Hyperlink: http://www.securityfocus.com/bid/19409 External Source: SECTRACK Name: 1016667 Hyperlink: http://securitytracker.com/id?1016667 External Source: XF Name: ms-server-service-bo(28002) Hyperlink: http://xforce.iss.net/xforce/xfdb/28002 External Source: CISCO Name: 20060814 Mitigating Exploitation of the MS06-040 Service Buffer Vulnerability Hyperlink: http://www.cisco.com/en/US/products/ps6120/tsd_products_security_response09186a008070c75a.html External Source: OVAL Name: oval:org.mitre.oval:def:492 Hyperlink: http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:492 ### Vulnerable Software and Vendor Windows 2000 (Microsoft) Windows Server 2003 (Microsoft) Windows XP (Microsoft) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3439