PT-2009-3702 · Microsoft · Windows 2000 Sp4+1

Joshua J. Drake · Publicado 2009-06-10 · Atualizado 2019-04-30 · CVE-2009-1138

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4

Description The issue is related to the LDAP service in Active Directory, which does not properly free memory for LDAP and LDAPS requests. This allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released. The problem is associated with a "DN AttributeValue" and is probably a memory leak.

Recommendations For Microsoft Windows 2000 SP4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-1138

Produtos afetados

Active Directory

Windows 2000 Sp4

Referências · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-018 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1138 · Nota de Segurança
• http://secunia.com/advisories/35355 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1537 · Aviso do Fabricante
• http://securitytracker.com/id?1022349 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=804 · Nota
• http://osvdb.org/54937 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6180 · Nota
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Nota
• http://securityfocus.com/bid/35226 · Correção
• http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm · Nota