[security-alerts] FW: [SA22866] Microsoft Windows Client Service for Netware Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Microsoft Windows Client Service for Netware Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA22866
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/22866/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> DoS, System access
> 
> WHERE:
> From local network
> 
> OPERATING SYSTEM:
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> 
> DESCRIPTION:
> Two vulnerabilities have been reported in Microsoft Windows, which
> can be exploited by malicious people to cause a DoS (Denial of
> Service) and compromise a vulnerable system.
> 
> 1) A boundary error in Client Service for Netware (CSNW) can be
> exploited to cause a buffer overflow via a specially crafted network
> message sent to the system.
> 
> Successful exploitation allows execution of arbitrary code.
> 
> 2) An unspecified error in Client Service for Netware can be
> exploited to cause the system to stop responding via a specially
> crafted network message.
> 
> SOLUTION:
> Apply patches.
> 
> Microsoft Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=3cf0b
0d1-ff07-40ac-a6ac-44dc4a54f91e
> 
> Microsoft Windows XP SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=2f542
58f-1071-467b-80a2-e4dbfc050667
> 
> Microsoft Windows Server 2003 (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=f2357
4f7-4033-45ac-8ad8-6cced2ee9285
> 
> PROVIDED AND/OR DISCOVERED BY:
> 1) The vendor credits Peter Winter-Smith of NGS Software and Sam Arun
> Raj of McAfee.
> 2) The vendor credits Sam Arun Raj of McAfee.
> 
> ORIGINAL ADVISORY:
> MS06-066 (KB923980):
> http://www.microsoft.com/technet/security/Bulletin/MS06-066.mspx
>