{"vuid":"VU#908276","idnumber":"908276","name":"Microsoft Winsock buffer overflow","keywords":["Microsoft","Winsock","Hostname","remote code execution","ms06-aug"],"overview":"A buffer overflow vulnerability in Microsoft Winsock may allow a remote attacker to execute arbitrary code on an affected system.","clean_desc":"Winsock (Windows Socket 2) allows network applications to relay data across a network regardless of the network protocol being used. Microsoft's Winsock contains a buffer overflow vulnerability that can allow a remote attacker to execute arbitrary code and gain control of the affected system. Exploitation of this vulnerability occurs when the remote attacker can convince the user to open a specially crafted file or website. Microsoft's bulletin states that the following Windows operating systems are affected by this vulnerability: Microsoft Windows 2000 Service Pack 4\nMicrosoft Windows XP Service Pack 1 and Service Pack 2\nMicrosoft Windows XP Professional x64 Edition\nMicrosoft Windows Server 2003 and Service Pack 1\nMicrosoft Windows Server 2003 for Itanium-based Systems and Service Pack 1\nMicrosoft Windows Server 2003 x64 Edition","impact":"A remote attacker who can successfully convince a user to open a specially crafted file or web site may be able to execute arbitrary code and gain control of the affected system.","resolution":"Apply an update Microsoft has released updates in Microsoft Security Bulletin MS06-041 to address this issue.","workarounds":"Workaround Microsoft lists the following workaround for this vulnerability. Modify the Autodial DLL Modifying the Autodial DLL in the Windows registry will prevent specially crafted files and web sites from invoking the affected API. Please see the Microsoft Security Bulletin MS06-041 for further details and cautions regarding use of the Registry Editor. Click Start, click Run, and type regedit32, click OK\nLocate the following key within the Registry Editor: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock2\\Parameters\nDouble click the REG_SZ value AutoDialDLL\nSet the value to kernel32.dll\nClose the Registry Editor and reboot the system * Note that this workaround does NOT fix the underlying vulnerability but will help block known methods of attack.","sysaffected":"","thanks":"Thanks to Microsoft Security for reporting this vulnerability in \nMicrosoft Security Bulletin MS06-041\n. Microsoft, in turn, thanks Peter Winter Smith of NGS Software for reporting the vulnerability to them.","author":"This document was written by Katie Washok.","public":["h","t","t","p",":","/","/","w","w","w",".","m","i","c","r","o","s","o","f","t",".","c","o","m","/","t","e","c","h","n","e","t","/","s","e","c","u","r","i","t","y","/","b","u","l","l","e","t","i","n","/","m","s","0","6","-","0","4","1",".","m","s","p","x"],"cveids":["CVE-2006-3440"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-08-08T17:54:34Z","publicdate":"2006-08-08T00:00:00Z","datefirstpublished":"2006-08-08T21:02:29Z","dateupdated":"2006-08-08T21:09:06Z","revision":28,"vrda_d1_directreport":"0","vrda_d1_population":"4","vrda_d1_impact":"4","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"15","cam_impact":"19","cam_easeofexploitation":"8","cam_attackeraccessrequired":"20","cam_scorecurrent":"12.825","cam_scorecurrentwidelyknown":"17.1","cam_scorecurrentwidelyknownexploited":"34.2","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":12.825,"vulnote":null}