PT-2010-1850 · Microsoft · Windows+1
Publicado
2010-04-14
·
Atualizado
2020-04-09
·
CVE-2010-0025
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2
Exchange Server version 2000 SP3
Description
The issue is related to the improper allocation of memory for SMTP command replies in the SMTP component. This allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command. An attacker could exploit this by sending invalid commands, followed by the STARTTLS command, to an affected server, potentially reading random e-mail message fragments stored on the server. This does not allow code execution or user rights elevation but could provide useful information for further system compromise.
Recommendations
For Microsoft Windows versions 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, consider restricting access to the SMTP component until a patch is available.
For Exchange Server version 2000 SP3, restrict access to the SMTP component to minimize the risk of exploitation.
As a temporary workaround, consider disabling the
STARTTLS command in the SMTP component until a patch is available.Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Exchange Server
Windows