Executive Summary

Summary
Title Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (974392)
Informations
Name MS09-069 First vendor Publication 2009-12-08
Vendor Microsoft Last vendor Modification 2009-12-08
Severity (Vendor) Important Revision 1.0

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:C)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Revision Note: V1.0 (December 8, 2009): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow a denial of service if a remote, authenticated attacker, while communicating through Internet Protocol security (IPsec), sends a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS) on an affected system.

Original Source

Url : http://technet.microsoft.com/en-us/security/bulletin/MS09-069

CWE : Common Weakness Enumeration

idName
CWE-399Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:6639
 
Oval ID: oval:org.mitre.oval:def:6639
Title: Local Security Authority Subsystem Service Resource Exhaustion Vulnerability
Description: LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote authenticated users to cause a denial of service (CPU consumption) via a malformed ISAKMP request over IPsec, aka "Local Security Authority Subsystem Service Resource Exhaustion Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-3675
Version: 1
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os1
Os3
Os3

OpenVAS Exploits

DateDescription
2009-12-09Name : Microsoft Windows LSASS Denial of Service Vulnerability (975467)
File : nvt/secpod_ms09-069.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
60831Microsoft Windows Local Security Authority Subsystem (LSASS) ISAKMP Message H...

Information Assurance Vulnerability Management (IAVM)

DateDescription
2009-12-10IAVM : 2009-B-0064 - Microsoft Windows Local Security Authority Subsystem Service (LSASS) Denial o...
Severity : Category II - VMSKEY : V0022096

Nessus® Vulnerability Scanner

DateDescription
2009-12-08Name : The remote Windows host has a denial of service vulnerability.
File : smb_nt_ms09-069.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 11:46:24
  • Multiple Updates
2013-11-11 12:41:14
  • Multiple Updates