CVE-2010-0025

Опубликовано: 14 апр. 2010

Источник: nvd

CVSS2: 5

EPSS Средний

Описание

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, aka "SMTP Memory Allocation Vulnerability."

Ссылки

http://secunia.com/advisories/39253
Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA10-103A.html
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12175
Third Party Advisory
http://secunia.com/advisories/39253
Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA10-103A.html
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12175
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2008:-:r2:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*

Конфигурация 5

Одно из

cpe:2.3:a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2007:sp1:*:*:*:*:x64:*

cpe:2.3:a:microsoft:exchange_server:2007:sp2:*:*:*:*:x64:*

cpe:2.3:a:microsoft:exchange_server:2010:-:*:*:*:*:x64:*

EPSS

Процентиль: 98%

0.59398

Средний

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-hx33-6cv9-3m88

github

почти 4 года назад

EPSS

Процентиль: 98%

0.59398

Средний

5 Medium

CVSS2

Дефекты

CWE-200