PT-2010-2238 · Microsoft · Windows Server 2008 R2+2

Published 2010-04-14 · Updated 2018-10-30 · CVE-2010-0477

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 Microsoft Windows 7

Description The issue arises from the improper handling of SMBv1 and SMBv2 response packets by the SMB client, allowing remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted packet. This can lead to the client reading the entirety of the response and then improperly interacting with the Winsock Kernel (WSK). An unauthenticated remote code execution vulnerability exists in the way that the Microsoft Server Message Block (SMB) client implementation handles specially crafted SMB responses. An attacker who successfully exploited this vulnerability could take complete control of the system.

Recommendations For Microsoft Windows Server 2008 R2, apply the necessary patch to fix the SMB client implementation. For Microsoft Windows 7, apply the necessary patch to fix the SMB client implementation. As a temporary workaround, consider restricting access to SMB services until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-0477

Affected Products

Windows 7

Windows Server 2008 R2

Windows

References · 8

• 🔥 https://exploit-db.com/exploits/12273 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0477 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0477 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-020 · Vendor Advisory
• http://secunia.com/advisories/39372 · Note
• http://us-cert.gov/cas/techalerts/TA10-103A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6859 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-020 · Note