Microsoft Windows Knowledge Base Article 971468 update is not installed (WinMs10kb971468Update)

Microsoft Windows Knowledge Base Article 971468 update is not installed (WinMs10kb971468Update)

Vuln ID:	55910
Risk Level:	High	WinMs10kb971468Update
Platforms:	Microsoft Windows 2000: SP4, Microsoft Windows XP: SP2, Microsoft Windows Vista, Microsoft Windows Server 2003: SP2, Microsoft Windows Server 2003: SP2 Itanium, Microsoft Windows Server 2003: SP2 x64, Microsoft Windows Vista: x64, Microsoft Windows XP: SP2 x64 Professional, Microsoft Windows Vista: SP1, Microsoft Windows Vista: SP1 x64, Microsoft Windows Server 2008: Itanium, Microsoft Windows Server 2008: x32, Microsoft Windows Server 2008: x64, Microsoft Windows XP: SP3, Microsoft Windows Vista: SP2 x64, Microsoft Windows Vista: SP2, Microsoft Windows Server 2008: SP2 x32, Microsoft Windows Server 2008: SP2 x64, Microsoft Windows 7: x64, Microsoft Windows 7: x32, Microsoft Windows Server 2008: R2 x64, Microsoft Windows Server 2008: R2 Itanium, Microsoft Windows Server 2008: SP2 Itanium
Description:	Microsoft Windows Knowledge Base Article 971468 update is not installed on the system, which could allow an attacker to exploit the following vulnerabilities: Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the improper handling of malicious SMB responses within the pathname by the Microsoft Server Message Block (SMB) Protocol software. By sending a specially-crafted SMB packet to a computer connected to an SMB Server, a remote attacker could exploit this vulnerability to execute arbitrary code on the system. Microsoft Windows is vulnerable to a denial of service, caused by the improper handling of SMB packets by the Microsoft Server Message Block (SMB) Protocol software. By sending a specially-crafted SMB packet to a computer connected to an SMB Server, a remote attacker could exploit this vulnerability to corrupt memory and cause the system to stop responding. Microsoft Windows is vulnerable to a denial of service, caused by a NULL pointer dereference by the Microsoft Server Message Block (SMB) Protocol software when handling of SMB packets. By sending a specially-crafted SMB packet to a computer connected to an SMB Server, a remote attacker could exploit this vulnerability to cause the computer to stop responding. Microsoft Windows could allow a remote attacker to gain elevated privileges on the system, caused by the improper handling of NTLM authentication attempts by the Microsoft Server Message Block (SMB) Protocol software. By sending an overly large amount of authentication requests to the SMB server, a remote attacker could exploit this vulnerability to access the SMB service to gain elevated privileges on the system.
Remedy:	Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS10-012. See References.
False Positives:
False Negatives:
Required Permission:	Windows login
Additional Information:
References:	IBM Internet Security Systems X-Force Database Microsoft Windows SMB pathname code execution http://xforce.iss.net/xforce/xfdb/55906 IBM Internet Security Systems X-Force Database Microsoft Windows SMB denial of service http://xforce.iss.net/xforce/xfdb/55907 IBM Internet Security Systems X-Force Database Vulnerabilities in SMB Server Could Allow Remote Code Execution (971468) http://xforce.iss.net/xforce/xfdb/55908 IBM Internet Security Systems X-Force Database Microsoft Windows SMB NTLM privilege escalation http://xforce.iss.net/xforce/xfdb/55909 Microsoft Security Bulletin MS10-012 Vulnerabilities in SMB Server Could Allow Remote Code Execution (971468) http://www.microsoft.com/technet/security/bulletin/ms10-012.mspx ISS X-Force Microsoft Windows Knowledge Base Article 971468 update is not installed http://www.iss.net/security_center/static/55910.php CVE CVE-2010-0231 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0231 CVE CVE-2010-0022 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0022 CVE CVE-2010-0020 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0020 CVE CVE-2010-0021 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0021

Know Your Risks

Common Vulnerabilties & Exposures