The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service (infinite loop and system hang) via a (1) SMBv1 or (2) SMBv2 response packet that contains (a) an incorrect length value in a NetBIOS header or (b) an additional length field at the end of this response packet, aka "SMB Client Incomplete Response Vulnerability."

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The version of the SMB client software installed on the remote Windows host may be affected by one or more vulnerabilities, including some that could allow arbitrary code execution :

  - Incorrect handling of incomplete SMB responses could     be abused to cause the system to stop responding.
    (CVE-2009-3676)

  - A vulnerability in the way the SMB client allocates     memory when parsing specially crafted SMB responses     could be abused by an unauthenticated, remote attacker     to execute arbitrary code with system-level privileges.
    (CVE-2010-0269)

  - Improper validation of fields in SMB responses could     lead to a memory corruption issue and in turn to     arbitrary code execution with system-level privileges.
    (CVE-2010-0270)

  - Improper parsing of SMB transaction responses could     lead to a memory corruption issue resulting in code     execution with system-level privileges. (CVE-2010-0476)

  - Improper handling of SMB responses could cause the SMB     client to consume the entire response and indicate an     invalid value to the Winsock kernel, which in turn     could allow remote code execution and result in the     compromise of the affected system. (CVE-2010-0477)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
45507	MS10-020: Vulnerabilities in SMB Client Could Allow Remote Code Execution (980232)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2009-3676

medium

Tenable Plugins

critical

high