PT-2009-5949 · Microsoft · Peap+3

Published 2009-12-09 · Updated 2023-12-07 · CVE-2009-3677

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue concerns the Internet Authentication Service (IAS) not properly verifying credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request. This allows remote attackers to access network resources via a malformed request. An elevation of privilege vulnerability exists where an attacker could send a specially crafted Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) authentication request to obtain access to network resources under the privileges of a specific, authorized user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-255

CWE-94

Related Identifiers

CVE-2009-3677

Affected Products

Ias

Ms-Chap V2

Windows

Peap

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3677 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3677 · Security Note
• http://us-cert.gov/cas/techalerts/TA09-342A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-071 · Note
• http://securitytracker.com/id?1023291 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6209 · Note