PT-2009-4038 · Microsoft · Windows Xp+3

Cody Pierce · Published 2009-08-12 · Updated 2024-10-21 · CVE-2009-1544

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Vista Gold Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions Gold through SP2 Microsoft Windows Server 2008 versions Gold through SP2

Description: A double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to certain systems, or cause a denial of service via a crafted RPC message to other systems.

Recommendations: For Microsoft Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 SP2, update to a newer version to mitigate the risk. For Microsoft Windows Vista Gold, SP1, and SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 Gold and SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the Workstation service until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

CWE-399

Related Identifiers

CVE-2009-1544

Affected Products

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-1544 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-041 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6286 · Note
• https://t.me/cvenotify/99002 · Telegram Post