Executive Summary
| Summary | |
|---|---|
| Title | Vulnerability in Local Security Authority Subsystem Service Could Allow Elevation of Privilege (983539) |
| Informations | |||
|---|---|---|---|
| Name | MS10-068 | First vendor Publication | 2010-09-14 |
| Vendor | Microsoft | Last vendor Modification | 2010-09-14 |
| Severity (Vendor) | Important | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.0 (September 14, 2010): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The vulnerability could allow elevation of privilege if an authenticated attacker sent specially crafted Lightweight Directory Access Protocol (LDAP) messages to a listening LSASS server. In order to successfully exploit this vulnerability, an attacker must have a member account within the target Windows domain. However, the attacker does not need to have a workstation joined to the Windows domain. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS10-068.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:7120 | |||
| Oval ID: | oval:org.mitre.oval:def:7120 | ||
| Title: | LSASS Heap Overflow Vulnerability | ||
| Description: | Heap-based buffer overflow in the Local Security Authority Subsystem Service (LSASS), as used in Active Directory in Microsoft Windows Server 2003 SP2 and Windows Server 2008 Gold, SP2, and R2; Active Directory Application Mode (ADAM) in Windows XP SP2 and SP3 and Windows Server 2003 SP2; and Active Directory Lightweight Directory Service (AD LDS) in Windows Vista SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, allows remote authenticated users to execute arbitrary code via malformed LDAP messages, aka "LSASS Heap Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0820 | Version: | 17 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 | |
| Os | 5 | |
| Os | 1 | |
| Os | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-09-15 | Name : MS Local Security Authority Subsystem Service Privilege Elevation Vulnerabili... File : nvt/secpod_ms10-068.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 67987 | Microsoft Windows LSASS Implementation Malformed LDAP Message Handling Remote... Microsoft Windows contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is caused due to an error in the Local Security Authority Subsystem Service (LSASS) within the implementations of Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). This can be exploited to cause a heap-based buffer overflow by sending a specially crafted LDAP message to an affected LSASS server. It can allow execution of arbitrary code, but requires authentication with the LSASS server. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows LSASS integer overflow attempt RuleID : 17249 - Revision : 8 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-09-14 | Name : The version of Active Directory on the remote Windows host can be used to exe... File : smb_nt_ms10-068.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:41 |
|
| 2014-01-19 21:30:31 |
|
