Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
APP:MISC:CVE-2006-2371-BO |
|---|---|
Severity |
Minor |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Microsoft Windows RASMAN Registry Remote Code Execution |
Release Date |
2017/06/03 |
Update Number |
2912 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
APP: Microsoft Windows RASMAN Registry Remote Code Execution
This signature detects attempts to exploit a known vulnerability in the Microsoft Routing and Remote Access. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the targeted daemon.
Extended Description
Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability."
Affected Products
- Microsoft windows_2000 *
- Microsoft windows_2003_server datacenter_edition
- Microsoft windows_2003_server datacenter_edition_64-bit
- Microsoft windows_2003_server enterprise_64-bit
- Microsoft windows_2003_server enterprise_edition
- Microsoft windows_2003_server enterprise_edition_64-bit
- Microsoft windows_2003_server r2
- Microsoft windows_2003_server sp1
- Microsoft windows_2003_server standard
- Microsoft windows_2003_server standard_64-bit
- Microsoft windows_2003_server web
- Microsoft windows_xp *
References
- CVE: CVE-2006-2371