Rule:  --Sid:5730--Summary:A buffer overflow exists in the SMB (Server Message Block) Protocol implementation in Microsoft Windows 2000, Windows XP and Windows 2003 that allows attackers to cause a denial of service via a malformed request.--Impact:An attacker can cause the target system to lock up and require manual reboot.  With more research, an attacker may be able to exploit this buffer overflow and execute arbitrary code, but this research has not been made public at this time.--Detailed Information:SMB on a vulnerable system may crash if it recieves a specially crafted packet containing a malformed transaction request.  If either the paramaters "Max Parameter Count" or "Max Data Count" are set to 0, then a vulnerable system will crash.  NetServerEnum requests require an authorized user account, however NetServerEnum2 and NetServerEnum3 require anonymous access.  Anonymous access is enabled by default.--Affected Systems:Windows 2000 SP3Windows 2000 SP4Windows XP SP1Windows XP SP2Windows 2003 SP1--Attack Scenarios:Simple. An attacker would use one of the various publicly available tools to launch this attack.--Ease of Attack:Numerous tools, including a windows binary (SMBDie.exe), have been made publicly available to exploit the denial of service portion of this vulnerability.--False Positives:This rule may generate an event on functions other than NetServerEnum, NetServerEnum2, or NetServerEnum3.--False Negatives:None Known--Corrective Action:Apply the appropriate vendor supplied patches--Contributors:Sourcefire Vulnerability Research TeamLurene Grenier <lurene.grenier@sourcefire.com>Brian Caswell <bmc@snort.org>Nigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--