Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-0085 | First vendor Publication | 2009-03-10 |
| Vendor | Cve | Last vendor Modification | 2023-12-07 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:C/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 7.1 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the client's key exchange data in Transport Layer Security (TLS) handshake messages, which allows remote attackers to spoof authentication by crafting a TLS packet based on knowledge of the certificate but not the private key, aka "SChannel Spoofing Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0085 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:6011 | |||
| Oval ID: | oval:org.mitre.oval:def:6011 | ||
| Title: | SChannel Spoofing Vulnerability | ||
| Description: | The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the client's key exchange data in Transport Layer Security (TLS) handshake messages, which allows remote attackers to spoof authentication by crafting a TLS packet based on knowledge of the certificate but not the private key, aka "SChannel Spoofing Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-0085 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 4 | |
| Os | 3 | |
| Os | 3 | |
| Os | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-11 | Name : Vulnerability in SChannel Could Allow Spoofing (960225) File : nvt/secpod_ms09-007.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 52521 | Microsoft Windows SChannel Certificate Based Authentication Spoofing Bypass Windows contains a flaw that may allow a malicious user to authenticate against a protected server using only the public portion of a valid user's credential. The issue is triggered by weak certificate validation by the SChannel security component. It is possible that the flaw may allow unauthorized access to protected servers resulting in a loss of integrity. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2009-03-12 | IAVM : 2009-A-0019 - Microsoft Windows Secure Channel Vulnerability Severity : Category II - VMSKEY : V0018549 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows IIS SChannel improper certificate verification RuleID : 17431 - Revision : 12 - Type : SERVER-IIS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-03-11 | Name : It may be possible to spoof user identities. File : smb_nt_ms09-007.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2023-12-07 21:28:06 |
|
| 2021-05-04 12:09:00 |
|
| 2021-04-22 01:09:20 |
|
| 2020-05-23 00:23:12 |
|
| 2019-02-26 17:19:31 |
|
| 2018-10-13 00:22:46 |
|
| 2017-09-29 09:24:01 |
|
| 2016-06-28 17:33:19 |
|
| 2016-04-26 18:33:01 |
|
| 2014-02-17 10:48:16 |
|
| 2014-01-19 21:25:33 |
|
| 2013-11-11 12:38:09 |
|
| 2013-05-10 23:41:47 |
|
