PT-2010-3515 · Microsoft · Windows Vista+3

Darren Willis · Publicado 2010-08-11 · Atualizado 2023-12-07 · CVE-2010-1892

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through R2 Microsoft Windows 7

Description A denial of service issue exists due to improper handling of malformed IPv6 packets by the TCP/IP stack. This allows remote attackers to cause a system hang via crafted packets. The issue arises from an error in processing specially crafted IPv6 packets with a malformed extension header. An attacker could exploit this by sending a small number of specially crafted packets, causing the system to stop responding.

Recommendations For Microsoft Windows Vista versions SP1 through SP2, update to a version that properly handles IPv6 packets to prevent the system hang. For Microsoft Windows Server 2008 versions Gold through R2, apply configuration changes to restrict the processing of malformed IPv6 packets. For Microsoft Windows 7, consider disabling IPv6 support until a patch is available to mitigate the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-1892

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Vista

Referências · 6

• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-058 · Nota
• http://us-cert.gov/cas/techalerts/TA10-222A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11845 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1892 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1892 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-058 · Aviso do Fabricante