PT-2010-2961 · Microsoft · Iis

Published 2010-06-08 · Updated 2023-12-07 · CVE-2010-1256

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft IIS versions 6.0 through 7.5

Description The issue allows remote authenticated users to execute arbitrary code via unknown vectors related to "token checking" that trigger memory corruption.

Recommendations For Microsoft IIS versions 6.0 through 7.5, update to a version where Extended Protection for Authentication is properly handled to prevent memory corruption.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-1256

Affected Products

Iis

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1256 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58864 · Note
• http://securityfocus.com/bid/40573 · Note
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7149 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1256 · Note