Executive Summary
| Summary | |
|---|---|
| Title | Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553) |
| Informations | |||
|---|---|---|---|
| Name | MS11-030 | First vendor Publication | 2011-04-12 |
| Vendor | Microsoft | Last vendor Modification | 2012-03-13 |
| Severity (Vendor) | Critical | Revision | 1.1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.1 (March 13, 2012): Added a link to Microsoft Knowledge Base Article 2509553 under Known Issues in the Executive Summary. |
Original Source
| Url : http://technet.microsoft.com/en-us/security/bulletin/ms11-030 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11902 | |||
| Oval ID: | oval:org.mitre.oval:def:11902 | ||
| Title: | DNS Query Vulnerability | ||
| Description: | DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process DNS queries, which allows remote attackers to execute arbitrary code via (1) a crafted LLMNR broadcast query or (2) a crafted application, aka "DNS Query Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0657 | Version: | 5 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-04-13 | Name : Microsoft DNS Resolution Remote Code Execution Vulnerability (2509553) File : nvt/secpod_ms11-030.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 71780 | Microsoft Windows DNS Client Service LLMNR Query Processing Remote Code Execu... Microsoft Windows contains a flaw related to the DNSAPI.dll component in the DNS client failing to properly process DNS queries. This may allow a remote attacker to use a crafted LLMNR broadcast query to TCP/UDP port 5355, or a crafted application to execute arbitrary code. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2011-04-14 | IAVM : 2011-A-0039 - Microsoft DNS Resolution Remote Code Execution Vulnerability Severity : Category I - VMSKEY : V0026514 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows LLMNR invalid reverse name lookup stack corruption attempt RuleID : 18655 - Revision : 12 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-04-21 | Name : Arbitrary code can be executed on the remote host through the installed Windo... File : llmnr-ms11-030.nasl - Type : ACT_GATHER_INFO |
| 2011-04-13 | Name : Arbitrary code can be executed on the remote host through the installed Windo... File : smb_nt_ms11-030.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:57 |
|
| 2014-01-19 21:30:39 |
|
| 2013-11-11 12:41:22 |
|
