Buffer overflow in Microsoft Windows 2000
CVE-2006-6696
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.9 (Medium). Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.034 (88.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.034 · newest: 0.034 · change: +0.000
Affected products
- Microsoft Windows 2000
- Microsoft Windows 2003 Server — versions datacenter_edition, enterprise_edition, sp1
- Microsoft Windows Vista
- Microsoft Windows Xp
Weakness classification (CWE)
References
- www.kuban.ru/forum_new/forum2/files/19124.html
- www.securityfocus.com/archive/1/455546/100/0/threaded (mailing-list)
- www.securityfocus.com/archive/1/466331/100/200/threaded (vendor-advisory)
- securitytracker.com/id (vdb-entry)
- groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/t…
- www.security.nnov.ru/Gnews944.html
- research.eeye.com/html/alerts/zeroday/20061215.html
- www.determina.com/security.research/vulnerabilities/csrss-harderror.html
- www.securityfocus.com/archive/1/455088/100/0/threaded (mailing-list)
- blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability…