PT-2010-4661 · Microsoft · Windows Server 2008 R2+1

Published 2010-10-13 · Updated 2018-10-12 · CVE-2010-3223

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2

Description A tampering issue exists due to improper handling of permissions on shared cluster disks by the Failover Cluster Manager user interface. The Failover Cluster Manager uses unsecured default permissions when adding disks to a cluster, potentially providing unauthorized users with read/write/delete access to the administrative shares on the failover cluster disk. This allows remote attackers to read or modify data on these disks via requests to the associated share.

Recommendations For Microsoft Windows Server 2008 R2, consider restricting access to the administrative shares on the failover cluster disk to minimize the risk of exploitation. As a temporary workaround, review and manually set proper permissions on new cluster disks that are shared as part of a failover cluster. Ensure that only authorized users have access to these shares.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-3223

Affected Products

Windows Server 2008 R2

Windows

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-3223 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-086 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3223 · Security Note
• http://securitytracker.com/id?1024558 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6789 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-086 · Note