MS10-029

Executive Summary

Summary
Title	Vulnerability in Windows ISATAP Component Could Allow Spoofing (978338)

Informations
Name	MS10-029	First vendor Publication	2010-04-13
Vendor	Microsoft	Last vendor Modification	2010-04-21
Severity (Vendor)	Moderate	Revision	1.1

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score	6.4	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Revision Note: V1.1 (April 21, 2010): Corrected the bulletin replacement information for all Windows Vista and Windows Server 2008 update packages.

Summary: This security update resolves one privately reported vulnerability in Microsoft Windows. This security update is rated Moderate for Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. Windows 7 and Windows Server 2008 R2 are not vulnerable because these operating systems include the feature deployed by this security update. For more information, see the subsection, Affected and Non-Affected Software, in this section.

Original Source

Url : http://www.microsoft.com/technet/security/bulletin/MS10-029.mspx

CWE : Common Weakness Enumeration

id	Name
CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7574

Oval ID:	oval:org.mitre.oval:def:7574
Title:	ISATAP IPv6 Source Address Spoofing Vulnerability
Description:	Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to bypass intended IPv4 source-address restrictions via a mismatched IPv6 source address in a tunneled ISATAP packet, aka "ISATAP IPv6 Source Address Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2010-0812	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
Windows XP SP2 Microsoft Windows XP (x86) SP2 is installed AND The version of Tcpip6.sys is less than 5.1.2600.3667 OR Windows XP SP3 Microsoft Windows XP (x86) SP3 is installed AND The version of Tcpip6.sys is less than 5.1.2600.5935 OR Windows XP x64 SP2, Server 2003 X86/X64/IA64 SP2 IF Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND The version of Tcpip6.sys is less than 5.2.3790.4662 OR Windows Vista x86/x64 - GDR IF Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND the version of Tcpip.sys is greater than or equal 6.0.6000.16000 AND The version of Tcpip.sys is less than 6.0.6000.17021 OR Windows Vista x86/x64 - LDR IF Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND the version of Tcpip.sys is greater than or equal 6.0.6000.20000 AND The version of Tcpip.sys is less than 6.0.6000.21226 OR Windows Vista x86/x64 SP1, Windows Server 2008 x86/x64/ia64 - GDR IF Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND Microsoft Windows Vista x64 Edition Service Pack 1 is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND the version of Tcpip.sys is greater than or equal 6.0.6001.18000 AND The version of Tcpip.sys is less than 6.0.6001.18427 OR Windows Vista x86/x64 SP1, Windows Server 2008 x86/x64/ia64 - LDR IF Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND Microsoft Windows Vista x64 Edition Service Pack 1 is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND the version of Tcpip.sys is greater than or equal 6.0.6001.22000 AND The version of Tcpip.sys is less than 6.0.6001.22636 OR Windows Vista x86/x64 SP2, Windows Server 2008 x86/x64/ia64 SP2 - GDR IF Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND the version of Tcpip.sys is greater than or equal 6.0.6002.18000 AND The version of Tcpip.sys is less than 6.0.6002.18209 OR Windows Vista x86/x64 SP2, Windows Server 2008 x86/x64/ia64 SP2 - LDR IF Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND the version of Tcpip.sys is greater than or equal 6.0.6002.22000 AND The version of Tcpip.sys is less than 6.0.6002.22341

CPE : Common Platform Enumeration

Type	Description	Count
Os	Microsoft Windows 2003 Server cpe:/o:microsoft:windows_2003_server::sp2:itanium cpe:/o:microsoft:windows_2003_server::sp2	2
Os	Microsoft Windows Server 2003 cpe:/o:microsoft:windows_server_2003::sp2:x64	1
Os	Microsoft Windows Server 2008 cpe:/o:microsoft:windows_server_2008:-:sp2:x32 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:x64 cpe:/o:microsoft:windows_server_2008:-:sp2:itanium cpe:/o:microsoft:windows_server_2008:::itanium cpe:/o:microsoft:windows_server_2008:::x64	6
Os	Microsoft Windows Vista cpe:/o:microsoft:windows_vista:-:sp1 cpe:/o:microsoft:windows_vista:-:sp2 cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_vista:::x64 cpe:/o:microsoft:windows_vista::sp1:x64 cpe:/o:microsoft:windows_vista::sp2:x64	6
Os	Microsoft Windows Xp cpe:/o:microsoft:windows_xp:-:sp2:x64 cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_xp::sp3	3