Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-3677 | First vendor Publication | 2009-12-09 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request, which allows remote attackers to access network resources via a malformed request, aka "MS-CHAP Authentication Bypass Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3677 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-255 | Credentials Management |
| 50 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:6209 | |||
| Oval ID: | oval:org.mitre.oval:def:6209 | ||
| Title: | MS-CHAP Authentication Bypass Vulnerability | ||
| Description: | The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request, which allows remote attackers to access network resources via a malformed request, aka "MS-CHAP Authentication Bypass Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3677 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 | |
| Os | 3 | |
| Os | 3 | |
| Os | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-12-09 | Name : Microsoft Windows IAS Remote Code Execution Vulnerability (974318) File : nvt/secpod_ms09-071.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 60833 | Microsoft Windows Internet Authentication Service Crafted MS-CHAP v2 Message ... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2009-12-10 | IAVM : 2009-A-0126 - Microsoft Internet Authentication Service Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0022101 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Internet Authentication Service EAP-MSCHAPv2 authentication bypass ... RuleID : 16329 - Revision : 8 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-12-08 | Name : The remote Windows host has multiple vulnerabilities in an authentication ser... File : smb_nt_ms09-071.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:09:48 |
|
| 2024-11-28 12:20:02 |
|
| 2023-12-07 21:28:05 |
|
| 2021-05-04 12:10:21 |
|
| 2021-04-22 01:10:47 |
|
| 2020-05-23 00:24:28 |
|
| 2019-02-26 17:19:32 |
|
| 2018-10-13 00:22:52 |
|
| 2017-09-19 09:23:27 |
|
| 2016-08-31 12:01:54 |
|
| 2016-06-28 17:52:05 |
|
| 2016-04-26 19:12:26 |
|
| 2014-02-17 10:52:02 |
|
| 2014-01-19 21:26:15 |
|
| 2013-11-11 12:38:25 |
|
| 2013-05-10 23:59:36 |
|
