Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges, via a crafted SMB Negotiate response, aka "SMB Client Race Condition Vulnerability."

The version of the SMB client software installed on the remote Windows host is affected by two vulnerabilities that could allow arbitrary code execution :

  - Improper validation of fields in SMB responses can lead     to a pool corruption issue and in turn to arbitrary     code execution with SYSTEM level privileges.
    (CVE-2010-0016)

  - Improper handling of a race condition involving SMB     'Negotiate' responses may allow a remote attacker to     execute arbitrary code, cause a denial of service, or     escalate his privileges. (CVE-2010-0017)

Note that successful exploitation of either issue requires an attacker to trick a user on the affected host into initiating an SMB connection to a malicious SMB server.

Detections

Analytics

CVE-2010-0017

high

Tenable Plugins

high