DESCRIPTION
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Microsoft Windows operating system. Authentication is not required to exploit this vulnerability and code execution occurs within the context of the kernel.

According to the Microsoft Developer Network (MSDN) documentation, Mailslot communications are divided into two classes. First-class Mailslots are connection oriented and operate over SMB/TCP. Second-class Mailslots provide connectionless messaging for broadcast messages and operate over SMB/UDP. Second-class Mailslots are limited to 424 bytes per message. First-class Mailslots are officially unsupported in the Windows 2000, XP and 2003 operating systems.

The specific flaw exists within the SRV.SYS driver, which is responsible for handling all Server Message Block (SMB) traffic. During the processing of first-class Mailslot messages, an exploitable memory corruption condition is created. As a side effect, attackers are also capable of exceeding the second-class Mailslot message size limitation.

It is important to note that this vulnerability affects more than just the Windows kernel. Applications built on Mailslot communications that rely on the message size restriction of second-class Mailslots are likely to be affected by this vulnerability.

TippingPoint Advisory