VULHUB ™

The file sharing (SMB) service in Windows enables client applications to access and modify files from a server on the network. The SMB service within Windows 95/98 allocates 0x400*4 bytes to store file handles. Therefore, a file handle returned to a client will be in the range 0 - 1023. When SMB commands such as SMBfindclose are sent to the service specifying a specially crafted handle out of that range, the sharing service will attempt to access illegal memory address. Successful exploitation of this vulnerability will cause the sharing service to buffer overflow and likely crash.

The file sharing (SMB) service in Windows enables client applications to access and modify files from a server on the network. The SMB service within Windows 95/98 allocates 0x400*4 bytes to store file handles. Therefore, a file handle returned to a client will be in the range 0 - 1023. When SMB commands such as SMBfindclose are sent to the service specifying a specially crafted handle out of that range, the sharing service will attempt to access illegal memory address. Successful exploitation of this vulnerability will cause the sharing service to buffer overflow and likely crash.