The server driver (srv.sys) in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet on an SMB PIPE that triggers a null dereference.

While investigating the Microsoft Server Service Mailslot heap overflow vulnerability reported in Microsoft Security Bulletin MS06-035 we discovered a second bug in the server service. This module exploits this vulnerability.

For more info go to

http://www.coresecurity.com/common/showdoc.php?idx=562&idxseccion=10

This module exploits a remotely exploitable vulnerability in Windows' Server Service (MS06-040) over Microsoft DCERPC (ports 139 and 445).



WARNING: This is an early release module.



This is not the final version of this module. It is a pre-released

version in order to deliver a module as quickly as possible to our

customers that may be useful in some situations. Since this module is

not the final version it may contain bugs or have limited functionality

and may not have complete or accurate documentation.
This module exploits a remote vulnerability that could allow an attacker to send a specially crafted SMB message to an affected system causing a denial of service (MS06-035).



WARNING: This is an early release module.



This is not the final version of this module. It is a pre-released

version in order to deliver a module as quickly as possible to our

customers that may be useful in some situations. Since this module is

not the final version it may contain bugs or have limited functionality

and may not have complete or accurate documentation.
This module sends a series of UDP packets containing malformed IAX2 requests that will crash vulnerable listening IAX clients. If a broadcast IP address is specified, an entire subnetwork can be attacked in a single run.