Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold…

Description

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Scores

EPSS (exploitation in 30 days)

92.3% · top 0.2% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 10.0.

Weakness

• n/a
• CWE-399 (opens in a new tab)All about CWE-399 and its CVEs

Affected products

• n/a

  • affected n/a

References (18)

• 36299 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• VU#135940 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• http://www.microsoft.com/technet/security/advisory/975497.mspx (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1 (opens in a new tab)x_refsource_MISCx_transferred
• http://blog.48bits.com/?p=510 (opens in a new tab)x_refsource_MISCx_transferred
• MS09-050 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
• TA09-286A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• http://isc.sans.org/diary.html?storyid=7093 (opens in a new tab)x_refsource_MISCx_transferred
• 36623 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html (opens in a new tab)x_refsource_MISCx_transferred
• 1022848 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 20090909 SMB SRV2.SYS Denial of Service PoC (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 9594 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• 20090907 Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 57799 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• win-srv2sys-code-execution(53090) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20090908 Regarding Microsoft srv2.sys SMB2.0 NEGOTIATE BSOD (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• oval:org.mitre.oval:def:6489 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-3103](https://trackcve.app/badge/CVE-2009-3103.svg)](https://trackcve.app/cve/CVE-2009-3103)

Record last updated 7 Aug 2024, 06:14 UTC.