Signature Detail

SCAN: pysmb Library Detected

This signature detects the pysmb library in use on your network. This library is used by several penetration testing suites to create exploits. These tools can be used legitimately to perform a network security audit of your network. However, if a network security audit is not in progress, triggering this signature can indicate that a malicious attacker is using one of these tools to compromise your network.

Extended Description

It has been reported that Microsoft Windows Workstation (WKSSVC.DLL) service is prone to a vulnerability that may allow a remote attacker to gain unauthorized access to a vulnerable host. The problem is in the handling of requests by the Workstation Service. The Workstation Service does not properly check bounds on remote data therefore making it possible to overwrite sensitive regions of system memory.

Affected Products

• Cisco broadband_troubleshooter
• Cisco building_broadband_service_manager_(bbsm) 2.5.1
• Cisco building_broadband_service_manager_(bbsm) 3.0.0
• Cisco building_broadband_service_manager_(bbsm) 4.0.1
• Cisco building_broadband_service_manager_(bbsm) 4.2.0
• Cisco building_broadband_service_manager_(bbsm) 4.3.0
• Cisco building_broadband_service_manager_(bbsm) 4.4.0
• Cisco building_broadband_service_manager_(bbsm) 4.5.0
• Cisco building_broadband_service_manager_(bbsm) 5.0.0
• Cisco building_broadband_service_manager_(bbsm) 5.1.0
• Cisco building_broadband_service_manager_hotspot 1.0.0
• Cisco call_manager 1.0.0
• Cisco call_manager 2.0.0
• Cisco call_manager 3.0.0
• Cisco call_manager 3.1.0
• Cisco call_manager 3.1.0 (2)
• Cisco call_manager 3.1.0 (3a)
• Cisco call_manager 3.2.0
• Cisco call_manager 3.3.0
• Cisco call_manager 3.3.0 (3)
• Cisco call_manager 4.0.0
• Cisco call_manager
• Cisco ciscoworks_vpn/security_management_solution
• Cisco collaboration_server
• Cisco conference_connection 1.1.0 (1)
• Cisco conference_connection 1.2.0
• Cisco conference_connection
• Cisco customer_response_application_server
• Cisco docsis_cpe_configurator
• Cisco dynamic_content_adapter
• Cisco e-mail_manager
• Cisco intelligent_contact_manager 5.0.0
• Cisco intelligent_contact_manager
• Cisco internet_service_node
• Cisco ip_call_center_express_(ipcc_express)_enhanced 3.0.0
• Cisco ip_call_center_express_(ipcc_express)_standard 3.0.0
• Cisco ip_telephony_environment_monitor
• Cisco ip/tv_server
• Cisco ip/vc_3540_application_server
• Cisco ip/vc_3540_video_rate_matching_module
• Cisco lan_management_solution
• Cisco media_blender
• Cisco networking_services_for_active_directory
• Cisco network_registar
• Cisco personal_assistant 1.3.0 (1)
• Cisco personal_assistant 1.3.0 (2)
• Cisco personal_assistant 1.3.0 (3)
• Cisco personal_assistant 1.3.0 (4)
• Cisco personal_assistant 1.4.0 (1)
• Cisco personal_assistant 1.4.0 (2)
• Cisco personal_assistant
• Cisco qos_policy_manager
• Cisco routed_wan_management
• Cisco secure_access_control_server 3.2.0 (1.20)
• Cisco secure_access_control_server 3.2.1
• Cisco secure_access_control_server 3.2.2
• Cisco secure_access_control_server
• Cisco secure_policy_manager 3.0.1
• Cisco secure_scanner
• Cisco service_management
• Cisco small_network_management_solution
• Cisco sn_5420_storage_router 1.1.0 (2)
• Cisco sn_5420_storage_router 1.1.0 (3)
• Cisco sn_5420_storage_router 1.1.0 (4)
• Cisco sn_5420_storage_router 1.1.0 (5)
• Cisco sn_5420_storage_router 1.1.0 (7)
• Cisco sn_5420_storage_router 1.1.3
• Cisco sn_5428_storage_router SN5428-2-3.3.1-K9
• Cisco sn_5428_storage_router SN5428-2-3.3.2-K9
• Cisco sn_5428_storage_router SN5428-2.5.1-K9
• Cisco sn_5428_storage_router SN5428-3.2.1-K9
• Cisco sn_5428_storage_router SN5428-3.2.2-K9
• Cisco sn_5428_storage_router SN5428-3.3.1-K9
• Cisco sn_5428_storage_router SN5428-3.3.2-K9
• Cisco trailhead
• Cisco transport_manager
• Cisco unity_server 2.0.0
• Cisco unity_server 2.1.0
• Cisco unity_server 2.2.0
• Cisco unity_server 2.3.0
• Cisco unity_server 2.4.0
• Cisco unity_server 2.46.0
• Cisco unity_server 3.0.0
• Cisco unity_server 3.1.0
• Cisco unity_server 3.2.0
• Cisco unity_server 3.3.0
• Cisco unity_server 4.0.0
• Cisco unity_server
• Cisco uone_enterprise_edition
• Cisco user_registration_tool
• Cisco voice_manager
• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_2000_server
• Microsoft windows_xp_64-bit_edition SP1
• Microsoft windows_xp_64-bit_edition
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional

References

• BugTraq: 9011
• CVE: CVE-2003-0812
• URL: http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx