Description
The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseHardError function with status 0x50000018, a different vulnerability than CVE-2006-6696.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Windows - 'Csrss.exe/winsrv.dll' NtRaiseHardError Double-Free EDB-3052 · dos · Dec 31, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- HPSBST02208 vendor-advisory
- oval:org.mitre.oval:def:2013 vdb-entry signature
- http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=43
- 1017454 vdb-entry
- win-ntraiseharderror-information-disclosure(31176) vdb-entry
- 23491 third-party-advisory
- VU#740636 third-party-advisory
- MS07-021 vendor-advisory
- ADV-2007-1325 vdb-entry
- ADV-2006-5197 vdb-entry
- 20061227 NtRaiseHardError Csrss.exe memory Disclosure exploit mailing-list
- http://www.reversemode.com/index.php?option=com_content&task=view&id=29&Itemid=2
- TA07-100A third-party-advisory
- 2086 third-party-advisory