PT-2008-3741 · Microsoft · Windows Vista+3
Publicado
2008-08-12
·
Atualizado
2018-10-30
·
CVE-2008-2246
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Microsoft Windows Vista through SP1 and Server 2008
Description:
The issue arises from the improper import of the default IPsec policy from a Windows Server 2003 domain to a Windows Server 2008 domain. This prevents IPsec rules from being enforced, allowing remote attackers to bypass intended access restrictions. As a result, systems may ignore IPsec policies and transmit network traffic in clear text, potentially disclosing information intended to be encrypted. An attacker intercepting the traffic could view and possibly modify the contents, although this would not directly allow code execution or user rights elevation. It could, however, be used to collect useful information for further system compromise.
Recommendations:
For Microsoft Windows Vista through SP1 and Server 2008, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Windows
Windows Server 2003
Windows Server 2008
Windows Vista