CVE-2009-1925
En bref
- Source
- NVD
- EPSS
- EPSS 27.40 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Modified
Rechercher sur…
Description
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state information, which allows remote attackers to execute arbitrary code by sending packets to a listening service, and thereby triggering misinterpretation of an unspecified field as a function pointer, aka "TCP/IP Timestamps Code Execution Vulnerability."
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2009-1920
- GCVE · GCVE-0-2009-1925
Avis du CERT-FR
- CERTA-2009-AVI-372 — Multiples vulnérabilités dans TCP/IP sous Windows · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:-:x32:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:-:x64:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:-:-:x64:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |