Microsoft SRV.SYS Mailslot Ring0 Memory Corruption VulnerabilityTPTI-06-02: July 11th, 2006
Windows 2000 SP4
Windows XP SP2
Windows 2003 SP1
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 4266. For further product information on the TippingPoint IPS:
Vulnerability DetailsThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Microsoft Windows operating system. Authentication is not required to exploit this vulnerability and code execution occurs within the context of the kernel.
According to the Microsoft Developer Network (MSDN) documentation, Mailslot communications are divided into two classes. First-class Mailslots are connection oriented and operate over SMB/TCP. Second-class Mailslots provide connectionless messaging for broadcast messages and operate over SMB/UDP. Second-class Mailslots are limited to 424 bytes per message. First-class Mailslots are officially unsupported in the Windows 2000, XP and 2003 operating systems.
The specific flaw exists within the SRV.SYS driver, which is responsible for handling all Server Message Block (SMB) traffic. During the processing of first-class Mailslot messages, an exploitable memory corruption condition is created. As a side effect, attackers are also capable of exceeding the second-class Mailslot message size limitation.
It is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots are likely to be affected by this vulnerability.
Vendor ResponseMicrosoft has issued an update to correct this vulnerability. More details can be found at:
2006-03-01 - Vulnerability reported to vendor
2006-07-11 - Coordinated public release of advisory