>> Microsoft Windows Heap Overflow and Information Disclosure Vulnerabilities (MS06-035)
Title : Microsoft Windows Heap Overflow and Information Disclosure Vulnerabilities (MS06-035) VUPEN ID : VUPEN/ADV-2006-2753 CVE ID : CVE-2006-1314 - CVE-2006-1315
Rated as : Critical
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2006-07-11
Technical Description
Two vulnerabilities have been identified in Microsoft Windows, which could be exploited by remote attackers to take complete control of an affected system or gain knowledge of sensitive information.
The first issue is due to a heap overflow error in the Server service when utilizing the mailslot mechanism, which could be exploited by remote attackers to execute arbitrary commands via a specially crafted network packet.
The second vulnerability is due to an uninitialized buffer in the Server protocol driver, which could be exploited by attackers to remotely read fragments of memory used to store Server Message Block (SMB) traffic during transport.
