Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability

["Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa () pacbell net>]

There's still an unpatched DOS for the server service as blogged on the 
MSRC blog:

Also - an additional point of clarification - its important to 
distinguish that while MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20> 
addresses a vulnerability in the Server Service it does not resolve the 
Denial of Service issue I spoke about earlier on the blog in the 
"Information About Public Postings Related to MS06-035 
<http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx>" posting. 
We are still working on the security update for the Denial of Service 
issue and the report for it came in after we had completed our testing 
cycle for MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>. 
With the importance and potential severity previously 
mentioned regarding MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>we 
felt it was important to get the security update for MS06-040 
<http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx%20>out 
as soon as possible. We'll continue working on the DoS issue and will 
release a security update once it's reached an appropriate level of quality.


public () frank4dd com wrote:
> After furiously patching since last week for catching up with MS06-040, we discovered that a old exploit for MS06-035 
> (again or still) works on a number fully patched systems including Windows 2003 Server, Windows XP and Windows 2000.
>
> The exploit that works is: http://milw0rm.org/exploits/2057
>
> All our tested systems (8 total) except one went into reboot after being hit with the exploit above. All tested systems 
> have been patched with the latest available patches from Microsoft as of today, August 14th, 2006 4:00 PM MESZ, using 
> both the standard Windows Update function and applying patches by hand.
> Explicit download of KB917159 patch, applying it and reboot, with no result. I carefully checked the version of the 
> srv.sys binary according to http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx and found it to be 
> correct, meaning the patch should be applied correctly.
>
> My only conclusion at this time is that the Microsoft delivered patch for MS06-035 does not work. Can anyone confirm 
> this behaviour?
>
> Thanks,
> Frank
>
> This is regarding MS06-035, CVE-2006-1314
>
>   

--
Letting your vendors set your risk analysis these days?  
http://www.threatcode.com

If you are a SBSer and you don't subscribe to the SBS Blog... man ... I will hunt you down...
http://blogs.technet.com/sbs