ID |
CVE-2010-0269
|
Summary |
The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly allocate memory for SMB responses, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response, aka "SMB Client Memory Allocation Vulnerability." |
References |
|
Vulnerable Configurations |
-
cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*
-
cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*
|
CVSS |
Base: | 10.0 (as of 26-02-2019 - 14:04) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-399 |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
COMPLETE |
COMPLETE |
COMPLETE |
|
cvss-vector
via4
|
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
msbulletin
via4
|
bulletin_id | MS10-020 | bulletin_url | | date | 2010-04-13T00:00:00 | impact | Remote Code Execution | knowledgebase_id | 980232 | knowledgebase_url | | severity | Critical | title | Vulnerabilities in SMB Client Could Allow Remote Code Execution |
|
oval
via4
|
accepted | 2014-03-03T04:01:20.523-05:00 | class | vulnerability | contributors | name | Dragos Prisaca | organization | Symantec Corporation |
name | Dragos Prisaca | organization | Symantec Corporation |
name | Maria Mikhno | organization | ALTX-SOFT |
name | Maria Mikhno | organization | ALTX-SOFT |
| definition_extensions | comment | Microsoft Windows 2000 SP4 or later is installed | oval | oval:org.mitre.oval:def:229 |
comment | Microsoft Windows XP (x86) SP2 is installed | oval | oval:org.mitre.oval:def:754 |
comment | Microsoft Windows XP (x86) SP3 is installed | oval | oval:org.mitre.oval:def:5631 |
comment | Microsoft Windows XP x64 Edition SP2 is installed | oval | oval:org.mitre.oval:def:4193 |
comment | Microsoft Windows Server 2003 SP2 (x86) is installed | oval | oval:org.mitre.oval:def:1935 |
comment | Microsoft Windows Server 2003 SP2 (x64) is installed | oval | oval:org.mitre.oval:def:2161 |
comment | Microsoft Windows Server 2003 (ia64) SP2 is installed | oval | oval:org.mitre.oval:def:1442 |
comment | Microsoft Windows Vista (32-bit) is installed | oval | oval:org.mitre.oval:def:1282 |
comment | Microsoft Windows Vista x64 Edition is installed | oval | oval:org.mitre.oval:def:2041 |
comment | Microsoft Windows Vista (32-bit) is installed | oval | oval:org.mitre.oval:def:1282 |
comment | Microsoft Windows Vista x64 Edition is installed | oval | oval:org.mitre.oval:def:2041 |
comment | Microsoft Windows Vista (32-bit) Service Pack 1 is installed | oval | oval:org.mitre.oval:def:4873 |
comment | Microsoft Windows Vista x64 Edition Service Pack 1 is installed | oval | oval:org.mitre.oval:def:5254 |
comment | Microsoft Windows Server 2008 (32-bit) is installed | oval | oval:org.mitre.oval:def:4870 |
comment | Microsoft Windows Server 2008 (64-bit) is installed | oval | oval:org.mitre.oval:def:5356 |
comment | Microsoft Windows Server 2008 (ia-64) is installed | oval | oval:org.mitre.oval:def:5667 |
comment | Microsoft Windows Vista (32-bit) Service Pack 1 is installed | oval | oval:org.mitre.oval:def:4873 |
comment | Microsoft Windows Vista x64 Edition Service Pack 1 is installed | oval | oval:org.mitre.oval:def:5254 |
comment | Microsoft Windows Server 2008 (32-bit) is installed | oval | oval:org.mitre.oval:def:4870 |
comment | Microsoft Windows Server 2008 (64-bit) is installed | oval | oval:org.mitre.oval:def:5356 |
comment | Microsoft Windows Server 2008 (ia-64) is installed | oval | oval:org.mitre.oval:def:5667 |
comment | Microsoft Windows Vista (32-bit) Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6124 |
comment | Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed | oval | oval:org.mitre.oval:def:5653 |
comment | Microsoft Windows Vista x64 Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:5594 |
comment | Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6216 |
comment | Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6150 |
comment | Microsoft Windows Vista (32-bit) Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6124 |
comment | Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed | oval | oval:org.mitre.oval:def:5653 |
comment | Microsoft Windows Vista x64 Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:5594 |
comment | Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6216 |
comment | Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed | oval | oval:org.mitre.oval:def:6150 |
comment | Microsoft Windows 7 (32-bit) is installed | oval | oval:org.mitre.oval:def:6165 |
comment | Microsoft Windows 7 x64 Edition is installed | oval | oval:org.mitre.oval:def:5950 |
comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | oval | oval:org.mitre.oval:def:6438 |
comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | oval | oval:org.mitre.oval:def:5954 |
comment | Microsoft Windows 7 (32-bit) is installed | oval | oval:org.mitre.oval:def:6165 |
comment | Microsoft Windows 7 x64 Edition is installed | oval | oval:org.mitre.oval:def:5950 |
comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | oval | oval:org.mitre.oval:def:6438 |
comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | oval | oval:org.mitre.oval:def:5954 |
| description | The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly allocate memory for SMB responses, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response, aka "SMB Client Memory Allocation Vulnerability." | family | windows | id | oval:org.mitre.oval:def:7129 | status | accepted | submitted | 2010-03-13T13:00:00 | title | SMB Client Memory Allocation Vulnerability | version | 51 |
|
refmap
via4
|
cert | TA10-103A | secunia | 39372 |
|
Last major update |
26-02-2019 - 14:04 |
Published |
14-04-2010 - 16:00 |
Last modified |
26-02-2019 - 14:04 |