Graham Perrin's List: code 49767 list 001

• Microsoft Windows 7, Server 2008, and Vista Gold, SP1, and SP2
• denial of service (system crash)
• http://secunia.com/advisories/36623
• http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html

2 more annotations...

• If you use any of the following operating systems:
  
  * Microsoft Windows 7
  * Microsoft Windows Vista
  * Microsoft Windows Server 2008
  
  -- please be aware of a recently reported zero day vulnerability affecting some versions. A denial-of-service attack on an affected system that has SMB2 enabled, for file sharing crashes the system with a BSoD (Blue Screen of Death).
  
  In addition: the issue may be exploitable to achieve remote code execution.
  
  Symantec Corp. ThreatCon is currently elevated (level 2 of 4).
  
  Secunia Advisory SA36623 currently rates the vulnerability moderately critical (3 of 5).
  
  U.S. National Vulnerability Database vulnerability CVE-2009-3103 will gain a completed summary in due course.
  
  The following actions are advised:
  
  * disable file sharing, unless it is explicitly required
  * restrict access to TCP ports 139 and 445. - Graham Perrin on 2009-09-09

• ThreatCon is currently at Level 2: Elevated
• remotely exploitable vulnerability affecting the SMB kernel component ('srv2.sys') of Windows Vista SP1 (and later) and possibly some versions of Windows 2008 and Windows 7
• trigger a crash
• the issue may be exploitable to achieve remote code execution
• in the short term the issue may be used for a denial-of-service attack
• We strongly advise users to block TCP port 445 immediately
• Unless explicitly required, users should disable file sharing

5 more annotations...

• exploit

  • In their currently published
    /data/vulnerabilities/exploits/36299.py
    there is line break error between lines 2 and 3.
  Add Sticky Note

• SMB2 BSOD 0Day
• Vista/2008/Windows 7
• confirmed
• recommend filtering access to port TCP 445
• might be a Remote Exploit vulnerability
• not merely a DOS
• especially if it does more than a simple DoS
• much more early distribution of real exploit code going on now than ever before
• SMB has got to be one of the biggest offenders for 0days
• In our enterprise, the top vulns are all SMB or Adobe based

8 more annotations...