=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2011/VULN320
_____________________________________________________________________

DATE                      : 13/04/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Windows version XP, 2003, Vista, 2008, 7 running SMB Server.

======================================================================
http://www.microsoft.com/technet/security/Bulletin/MS11-020.mspx
______________________________________________________________________

Microsoft Security Bulletin MS11-020 - Critical
Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft
Windows. The vulnerability could allow remote code execution if an attacker
created a specially crafted SMB packet and sent the packet to an affected
system. Firewall best practices and standard default firewall configurations
can help protect networks from attacks originating outside the enterprise
perimeter that would attempt to exploit these vulnerabilities.

This security update is rated Critical for all supported releases of Microsoft
Windows. For more information, see the subsection, Affected and Non-Affected
Software, in this section.

The security update addresses the vulnerability by correcting the way that SMB
validates fields in malformed SMB requests. For more information about the
vulnerability, see the Frequently Asked Questions (FAQ) subsection for the
specific vulnerability entry under the next section, Vulnerability Information.
Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service

Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit
   Systems Service Pack 2*
Windows Server 2008 for x64-based Systems and Windows Server 2008 for
   x64-based Systems Service Pack 2*
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for
   Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems*
Windows Server 2008 R2 for x64-based Systems Service Pack 1*
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

*Server Core installation affected. This update applies, with the same
severity rating, to supported editions of Windows Server 2008 or Windows
Server 2008 R2 as indicated, whether or not installed using the Server Core
installation option.

SMB Transaction Parsing Vulnerability - CVE-2011-0661

An unauthenticated remote code execution vulnerability exists in the way that
Microsoft Server Message Block (SMB) Protocol software handles specially
crafted SMB packets. An attempt to exploit the vulnerability would not
require authentication, allowing an attacker to exploit the vulnerability by
sending a specially crafted SMB packet to a computer running the Server
service. An attacker who successfully exploited this vulnerability could take
complete control of the system.

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================