PT-2010-2540 · Microsoft · Windows

Published 2010-04-14 · Updated 2023-12-07 · CVE-2010-0812

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description A spoofing issue exists due to the way Windows checks the inner packet's IPv6 source address in a tunneled ISATAP packet. This could allow an attacker to impersonate an address and bypass edge or host firewalls. Additionally, information could be disclosed when the targeted computer replies to the message using the source IPv6 address that the attacker specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0812

Affected Products

Windows

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-029 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0812 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0812 · Security Note
• http://secunia.com/advisories/39382 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7574 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-029 · Note
• http://us-cert.gov/cas/techalerts/TA10-103A.html · Note