The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and reboot) via a crafted SMB transaction response that uses (1) SMBv1 or (2) SMBv2, aka "SMB Client Response Parsing Vulnerability."

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The version of the SMB client software installed on the remote Windows host may be affected by one or more vulnerabilities, including some that could allow arbitrary code execution :

  - Incorrect handling of incomplete SMB responses could     be abused to cause the system to stop responding.
    (CVE-2009-3676)

  - A vulnerability in the way the SMB client allocates     memory when parsing specially crafted SMB responses     could be abused by an unauthenticated, remote attacker     to execute arbitrary code with system-level privileges.
    (CVE-2010-0269)

  - Improper validation of fields in SMB responses could     lead to a memory corruption issue and in turn to     arbitrary code execution with system-level privileges.
    (CVE-2010-0270)

  - Improper parsing of SMB transaction responses could     lead to a memory corruption issue resulting in code     execution with system-level privileges. (CVE-2010-0476)

  - Improper handling of SMB responses could cause the SMB     client to consume the entire response and indicate an     invalid value to the Winsock kernel, which in turn     could allow remote code execution and result in the     compromise of the affected system. (CVE-2010-0477)

ID	Name	Product	Family	Type	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	Remote	critical
45507	MS10-020: Vulnerabilities in SMB Client Could Allow Remote Code Execution (980232)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2010-0476

high

Tenable Plugins

critical

high