Ruben Santamarta has reported two vulnerabilities in Microsoft Windows, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and gain escalated privileges.

1) An input validation error exists within the "MRxSmbCscIoctlOpenForCopyChunk()" function in MRXSMB.SYS when handling certain DeviceIoControl requests. This can be exploited to overwrite kernel memory and allows arbitrary code execution with escalated privileges.

2) An input validation error exists within the "MrxSmbCscIoctlCloseForCopyChunk()" function in MRXSMB.SYS when handling certain requests. This can be exploited to cause a deadlock, which potentially leads to a DoS, by passing an invalid handle to the function.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Ruben Santamarta

Changelog
Further details available in Customer Area

Original Advisory
MS06-030 (KB914389):
http://www.microsoft.com/technet/security/Bulletin/MS06-030.mspx

Reverse Mode:
http://www.reversemode.com/index.php?option=com_content&task=view&id=13&Itemid=5
http://www.reversemode.com/index.php?option=com_content&task=view&id=14&Itemid=5

iDEFENSE:
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=408
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=409

Deep Links
Links available in Customer Area