Oval Definition:	oval:org.mitre.oval:def:1816
Revision Date: 2012-11-19 Version: 50 Title: MsgBox (CSRSS) Remote Code Execution Vulnerability Description: Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL. Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2006-6696 Platform(s): Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows XP Product(s): Definition Synopsis Windows 2000 SP4 Microsoft Windows 2000 SP4 or later is installed AND The version of winsrv.dll is less than 5.0.2195.7135. OR Windows XP SP2 Microsoft Windows XP (x86) SP2 is installed AND The version of winsrv.dll is less than 5.1.2600.3103. OR Windows XP SP1 x64 Microsoft Windows XP SP1 (64-bit) is installed AND The version of winsrv.dll is less than 5.2.3790.2902. OR Windows XP SP2 x64 Microsoft Windows XP x64 Edition SP2 is installed AND The version of winsrv.dll is less than 5.2.3790.4043. OR Windows Server 2003 Gold versions Windows Server 2003 x86/ia64 Microsoft Windows Server 2003 (x86) Gold is installed OR Microsoft Windows Server 2003 (ia64) Gold is installed AND The version of winsrv.dll is less than 5.2.3790.658. OR Windows Server 2003 SP1 versions Windows Server 2003 x86/x64/ia64 SP1 Microsoft Windows Server 2003 SP1 (x86) is installed OR Microsoft Windows Server 2003 SP1 (x64) is installed OR Microsoft Windows Server 2003 SP1 for Itanium is installed AND The version of winsrv.dll is less than 5.2.3790.2902. OR Windows Server 2003 Service Pack 2 x86/x64/ia64 and winsrv.dll Windows Server 2003 Service Pack 2 x86/x64/ia64 Microsoft Windows Server 2003 SP2 (x86) is installed OR Microsoft Windows Server 2003 SP2 (x64) is installed OR Microsoft Windows Server 2003 (ia64) SP2 is installed AND The version of winsrv.dll is less than 5.2.3790.4043. OR Windows Vista Windows Vista x86/x64 Microsoft Windows Vista is installed OR Microsoft Windows Vista x64 Edition is installed AND GRD/LDR version Check The version of winsrv.dll is less than 6.0.6000.16445. OR LDR version check the version of winsrv.dll is greater than or equal 6.0.6000.20000 AND the version of winsrv.dll is less than 6.0.6000.20544
BACK