Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-0240 | First vendor Publication | 2010-02-10 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used, does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "Header MDL Fragmentation Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0240 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:8400 | |||
| Oval ID: | oval:org.mitre.oval:def:8400 | ||
| Title: | Header MDL Fragmentation Vulnerability | ||
| Description: | The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used, does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "Header MDL Fragmentation Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0240 | Version: | 1 |
| Platform(s): | Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-11-25 | Name : Microsoft Windows TCP/IP Could Allow Remote Code Execution (974145) File : nvt/gb_ms10-009.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 62249 | Microsoft Windows TCP/IP Stack ESP Over UDP Header MDL Fragmentation Remote C... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2010-02-18 | IAVM : 2010-A-0030 - Multiple Vulnerabilities in Microsoft Windows TCP/IP Severity : Category I - VMSKEY : V0022684 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows Ipv6pHandleRouterAdvertisement Route Information stack buff... RuleID : 18249 - Revision : 6 - Type : PROTOCOL-ICMP |
| 2014-01-10 | Microsoft Windows TCP SACK invalid range denial of service attempt RuleID : 16408 - Revision : 14 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows Ipv6pHandleRouterAdvertisement Prefix Information stack buf... RuleID : 16405 - Revision : 6 - Type : PROTOCOL-ICMP |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-02-09 | Name : The remote host has multiple vulnerabilities in its TCP/IP implementation. File : smb_nt_ms10-009.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:09:25 |
|
| 2024-11-28 12:21:00 |
|
| 2023-12-07 21:28:04 |
|
| 2021-05-04 12:11:05 |
|
| 2021-04-22 01:11:34 |
|
| 2020-05-23 00:25:09 |
|
| 2018-10-13 00:22:54 |
|
| 2017-09-19 09:23:36 |
|
| 2016-08-31 12:02:02 |
|
| 2016-06-28 18:00:29 |
|
| 2016-04-26 19:31:35 |
|
| 2014-02-17 10:53:27 |
|
| 2013-11-11 12:38:35 |
|
| 2013-05-10 23:16:53 |
|
