PT-2010-4665 · Microsoft · Windows Vista+5

Published 2010-10-13 · Updated 2023-12-07 · CVE-2010-3229

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fix, including Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7

Description A denial of service issue exists due to improper processing of client certificates during SSL and TLS handshakes. This allows remote attackers to cause a denial of service, leading to an LSASS outage and system reboot, by sending a crafted packet. The issue affects systems with IIS 7.x enabled, particularly when SSL is enabled, which is not a default configuration.

Recommendations For Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-3229

Affected Products

Iis 7.X

Lsass

Windows

Windows 7

Windows Server 2008

Windows Vista

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-3229 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-085 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3229 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• http://securityfocus.com/bid/43780 · Note
• http://support.avaya.com/css/P8/documents/100113338 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6806 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-085 · Note