PT-2010-2961 · Microsoft · Iis

CVE-2010-1256 · Publicado 2010-06-08 · Atualizado 2023-12-07

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft IIS versions 6.0 through 7.5

Description The issue allows remote authenticated users to execute arbitrary code via unknown vectors related to "token checking" that trigger memory corruption.

Recommendations For Microsoft IIS versions 6.0 through 7.5, update to a version where Extended Protection for Authentication is properly handled to prevent memory corruption.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-1256

Produtos afetados

Iis

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/58864 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-040 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1256 · Nota de Segurança
• http://securityfocus.com/bid/40573 · Nota
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7149 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1256 · Nota