CVE-2006-3942
- State
- Published
- Severity
- Not scored
- Published
- Jul 31, 2006
- Updated
- Aug 7, 2024
- Reserved
- Jul 31, 2006
Description
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20060728 Vulnerability in Server Driver could result in Denial of Servicethird-party-advisory
- ADV-2006-3037vdb-entry
- SSRT061264vendor-advisory
- 20060814 CORE-2006-0714: Microsoft SRV.SYS SMB_COM_TRANSACTION Denial of Servicemailing-list
- 19215vdb-entry
- MS06-063vendor-advisory
- http://www.coresecurity.com/common/showdoc.php?idx=562&idxseccion=10
- 1016606vdb-entry
- 21276third-party-advisory
- 1017035vdb-entry
- 27644vdb-entry
- smb-malformed-pipe(27999)vdb-entry
- oval:org.mitre.oval:def:428vdb-entrysignature
- http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.