PT-2010-3515 · Microsoft · Windows Vista+3

Darren Willis · Published 2010-08-11 · Updated 2023-12-07 · CVE-2010-1892

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through R2 Microsoft Windows 7

Description A denial of service issue exists due to improper handling of malformed IPv6 packets by the TCP/IP stack. This allows remote attackers to cause a system hang via crafted packets. The issue arises from an error in processing specially crafted IPv6 packets with a malformed extension header. An attacker could exploit this by sending a small number of specially crafted packets, causing the system to stop responding.

Recommendations For Microsoft Windows Vista versions SP1 through SP2, update to a version that properly handles IPv6 packets to prevent the system hang. For Microsoft Windows Server 2008 versions Gold through R2, apply configuration changes to restrict the processing of malformed IPv6 packets. For Microsoft Windows 7, consider disabling IPv6 support until a patch is available to mitigate the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-1892

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Vista

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-1892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1892 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-058 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-058 · Note
• http://us-cert.gov/cas/techalerts/TA10-222A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11845 · Note