CVE-2006-3840

The SMB Mailslot parsing functionality in PAM in multiple ISS products with XPU (24.39/1.78/epj/x.x.x.1780), including Proventia A, G, M, Server, and Desktop, BlackICE PC and Server Protection 3.6, and RealSecure 7.0, allows remote attackers to cause a denial of service (infinite loop) via a crafted SMB packet that is not properly handled by the SMB_Mailslot_Heap_Overflow decode.

• CWE-399

• http://secunia.com/advisories/21219Vendor Advisory
• http://securitytracker.com/id?1016590
• http://securitytracker.com/id?1016591
• http://securitytracker.com/id?1016592
• http://www.nsfocus.com/english/homepage/research/0607.htm
• http://www.securityfocus.com/archive/1/441278/100/0/threaded
• http://www.securityfocus.com/bid/19178
• http://www.vupen.com/english/advisories/2006/2996Vendor Advisory
• http://xforce.iss.net/xforce/alerts/id/230Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27965
• https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630
• http://secunia.com/advisories/21219Vendor Advisory
• http://securitytracker.com/id?1016590
• http://securitytracker.com/id?1016591
• http://securitytracker.com/id?1016592
• http://www.nsfocus.com/english/homepage/research/0607.htm
• http://www.securityfocus.com/archive/1/441278/100/0/threaded
• http://www.securityfocus.com/bid/19178
• http://www.vupen.com/english/advisories/2006/2996Vendor Advisory
• http://xforce.iss.net/xforce/alerts/id/230Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27965
• https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630

Published

Jul 27, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3833index.php in EJ3 TOPo 2.2.178 allows remote attackers to ove…
• CVE-2006-3834EJ3 TOPo 2.2.178 includes the password in cleartext in the I…
• CVE-2006-3835Apache Tomcat 5 before 5.5.17 allows remote attackers to lis…
• CVE-2006-3836Directory traversal vulnerability in index.php in UNIDOmedia…
• CVE-2006-3837delcookie.php in Professional Home Page Tools Guestbook chan…
• CVE-2006-3838Multiple stack-based buffer overflows in eIQnetworks Enterpr…
• CVE-2006-3841Cross-site scripting (XSS) vulnerability in WebScarab before…
• CVE-2006-3842Cross-site scripting (XSS) vulnerability in Zoho Virtual Off…
• CVE-2006-3843PHP remote file inclusion vulnerability in com_calendar.php …
• CVE-2006-3844Buffer overflow in Quick 'n Easy FTP Server 3.0 allows remot…
• CVE-2006-3845Stack-based buffer overflow in lzh.fmt in WinRAR 3.00 throug…
• CVE-2006-3846PHP remote file inclusion vulnerability in extadminmenus.cla…