PT-2010-1860 · Microsoft · Windows Server 2003+3

Published 2010-02-10 · Updated 2019-04-30 · CVE-2010-0035

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2008 Gold Microsoft Windows Server 2008 SP2

Description The Key Distribution Center (KDC) in Kerberos in Microsoft Windows, when a trust relationship with a non-Windows Kerberos realm exists, allows remote authenticated users to cause a denial of service via a crafted Ticket Granting Ticket (TGT) renewal request. This can result in a NULL pointer dereference and domain controller outage.

Recommendations For Microsoft Windows 2000 SP4, update to a version that includes the fix for this issue. For Microsoft Windows Server 2003 SP2, update to a version that includes the fix for this issue. For Microsoft Windows Server 2008 Gold, update to a version that includes the fix for this issue. For Microsoft Windows Server 2008 SP2, update to a version that includes the fix for this issue.

Fix

Related Identifiers

CVE-2010-0035

Affected Products

Kerberos

Windows 2000

Windows Server 2003

Windows Server 2008

References · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0035 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8428 · Note
• http://us-cert.gov/cas/techalerts/TA10-040A.html · Note