Bugtraq mailing list archives
[REVERSEMODE ADVISORY] MS06-030 - Microsoft Mrxsmb.sys privilege escalation advisory
From: Reversemode <advisories () reversemode com>
Date: Wed, 14 Jun 2006 00:00:56 +0200
Microsoft Server Message Block Redirector Driver (mrxsmb.sys)does not verify user-mode buffer properly, allowing to any user to overwrite any desired memory address. The successful exploitation results in Ring0 code execution. + Paper/Advisory: -Reversing mrxsmb.sys. Chapter I "Getting Ring0"-(pdf) + Exploit code (c source code) Both two can be downloaded at www.reversemode.com This issue has been addressed in the recent bulletin, MS06-030 . Ruben Santamarta, www.reversemode.com
Current thread:
- [REVERSEMODE ADVISORY] MS06-030 - Microsoft Mrxsmb.sys privilege escalation advisory Reversemode (Jun 13)