PT-2010-1846 · Microsoft · Windows 7+3

Published 2010-02-10 · Updated 2025-01-21 · CVE-2010-0021

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista versions Gold, SP1, and SP2 Microsoft Windows Server 2008 versions Gold, SP2, and R2 Microsoft Windows 7 (affected versions not specified)

Description A denial of service issue exists due to multiple race conditions in the SMB implementation in the Server service. This allows remote attackers to cause a system hang via crafted SMBv1 or SMBv2 Negotiate packets. The vulnerability can be exploited by sending a specially crafted network message to a computer running the Server service, and does not require authentication.

Recommendations For Microsoft Windows Vista versions Gold, SP1, and SP2: update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 versions Gold, SP2, and R2: update to a newer version to mitigate the risk. For Microsoft Windows 7: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2010-0021

Affected Products

Windows 7

Windows Server 2008

Windows Vista

Windows

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0021 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0021 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-012 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8524 · Note
• http://us-cert.gov/cas/techalerts/TA10-040A.html · Note