vulnwire
10.0crit

CVE-2006-2373in critical feed2 exploits

The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows lo…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
29.2%
percentile 98%
Public exploits
2
Exploit-DB

The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."

Exploit prediction (EPSS)

29.17% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-1911 Microsoft Windows XP/2000 - 'Mrxsmb.sys' Local Privilege Escalation (MS06-030) · local · 2006-06-14
  • EDB-1910 Microsoft Windows - NtClose DeadLock (MS06-030) · local · 2006-06-14

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • securitytracker.com /id?1016288 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1942 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • idefense.com /intelligence/vulnerabilities/display.php?id=408 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1730 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • vupen.com /english/advisories/2006/2327 · vdb-entry, x_refsource_VUPEN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1137 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • osvdb.org /26440 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/18356 · vdb-entry, x_refsource_BID, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2006/ms06-030 · vendor-advisory, x_refsource_MS, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2007 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1792 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1904 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • secunia.com /advisories/20635 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/26828 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.