CVE-2006-6696

EPSS 3.3%

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/2967unverified exploitdbwww.exploit-db.com/exploits/3024unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff http://isc.sans.org/diary.php?n&storyid=1965 http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051394.html http://research.eeye.com/html/alerts/zeroday/20061215.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-021 http://secunia.com/advisories/23448 http://securitytracker.com/id?1017433 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1816 http://www.determina.com/security.research/vulnerabilities/csrss-harderror.html http://www.kuban.ru/forum_new/forum2/files/19124.html http://www.securityfocus.com/archive/1/455061/100/0/threaded