Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold…

Exploit prediction (EPSS)

92.35% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

• Metasploit exploit/windows/smb/ms09_050_smb2_negotiate_func_index MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference · metasploit exploit, good rank · 2009-09-07
• Metasploit auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference · metasploit auxiliary, normal rank
• Metasploit auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference · metasploit auxiliary, normal rank
• EDB-9594 Microsoft Windows Vista/7 - SMB2.0 Negotiate Protocol Request Remote Blue Screen of Death (MS07-063) · dos · 2009-09-09
• EDB-40280 Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050) · remote · 2016-02-26
• EDB-16363 Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit) · remote · 2010-07-03
• EDB-14674 Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) · remote · 2010-08-17
• EDB-12524 Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service · dos · 2010-05-07
• EDB-10005 Microsoft Windows 7/2008 R2 - Remote Kernel Crash · dos · 2009-11-11

CVSS scores

Classification

Weakness

• CWE-399 Resource Management Errors

References

• securityfocus.com /bid/36299 · vdb-entry, x_refsource_BID, x_transferred
• kb.cert.org /vuls/id/135940 · third-party-advisory, x_refsource_CERT-VN, x_transferred
• microsoft.com /technet/security/advisory/975497.mspx · x_refsource_CONFIRM, x_transferred
• reversemode.com /index.php?option=com_content&task=view&id=64&Itemid=1 · x_refsource_MISC, x_transferred
• blog.48bits.com /?p=510 · x_refsource_MISC, x_transferred
• docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-050 · vendor-advisory, x_refsource_MS, x_transferred
• us-cert.gov /cas/techalerts/TA09-286A.html · third-party-advisory, x_refsource_CERT, x_transferred
• isc.sans.org /diary.html?storyid=7093 · x_refsource_MISC, x_transferred
• secunia.com /advisories/36623 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• g-laurent.blogspot.com /2009/09/windows-vista7-smb20-negotiate-protocol.html · x_refsource_MISC, x_transferred
• securitytracker.com /id?1022848 · vdb-entry, x_refsource_SECTRACK, x_transferred
• securityfocus.com /archive/1/506327/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• exploit-db.com /exploits/9594 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• archives.neohapsis.com /archives/fulldisclosure/2009-09/0090.html · mailing-list, x_refsource_FULLDISC, x_transferred
• osvdb.org /57799 · vdb-entry, x_refsource_OSVDB, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/53090 · vdb-entry, x_refsource_XF, x_transferred
• securityfocus.com /archive/1/506300/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6489 · vdb-entry, signature, x_refsource_OVAL, x_transferred

Sources

• CVE List: CVE-2009-3103
• NVD: CVE-2009-3103

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.