Microsoft Windows IAS服务MS-CHAP请求绕过认证漏洞（MS09-071）

BUGTRAQ ID: 37198 CVE ID: CVE-2009-3677 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的Internet认证服务中存在权限提升漏洞，发送了恶意MS-CHAP v2认证请求的攻击者可以以特定授权用户的权限获得对网络资源的访问。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft...

Microsoft Windows IAS服务远程内存破坏漏洞（MS09-071）

BUGTRAQ ID: 37197 CVE ID: CVE-2009-2505 Microsoft Windows是微软发布的非常流行的操作系统。 由于在处理受保护可扩展认证协议（PEAP）认证尝试时内存中错误的拷贝了服务器所接收到的消息，导致Internet认证服务的PEAP实现中存在内存破坏漏洞。成功利用这个漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 临时解决方法： 在Internet认证服务服务器上使用非MS-CHAP v2的PEAP的认证协议。 厂商补丁：...

Authentication flaw

The Internet Authentication Service IAS in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol PEAP authentication request, which allows remote...

Memory corruption

The Internet Authentication Service IAS in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol PEAP authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed...

CVE-2009-2505

The Internet Authentication Service IAS in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol PEAP authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed...

CVE-2009-2505

The Internet Authentication Service IAS in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol PEAP authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed...

CVE-2009-2505

CVE-2009-2505 is a remote code execution flaw in Internet Authentication Service (IAS) on Windows Vista SP2 and Windows Server 2008 SP2, caused by improper validation during MS-CHAP v2 over PEAP. The vulnerability stems from incorrect memory handling when processing PEAP authentication requests, ...

CVE-2009-3677

CVE-2009-3677 describes an elevation-of-privilege bypass in the Internet Authentication Service (IAS) used by Microsoft Windows products. The issue arises because MS-CHAP v2 authentication requests sent over PEAP are not properly validated, allowing remote attackers to gain access to network reso...

Microsoft Windows IAS Remote Code Execution Vulnerability (974318)

This host is missing a critical security update according to Microsoft Bulletin MS09-071. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Security Bulletin MS09-071 - Critical Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution (974318)

Microsoft Security Bulletin MS09-071 - Critical Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution 974318 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...

Microsoft Patches Critical IE, Windows Vulnerabilities

Microsoft today shipped six bulletins with patches for a total of 12 documented security vulnerabilities in a wide range of widely deployed software products. Three of the six bulletins are rated “critical,” Microsoft’s highest severity rating. The most serious issues affect the company’s Interne...

Microsoft Protected Extensible Authentication Protocol Memory Corruption Vulnerability

Description The implementation of the Microsoft Protected Extensible Authentication Protocol PEAP used by Microsoft's Internet Authentication System is prone to a remote memory-corruption vulnerability. A remote attacker can exploit this issue to execute arbitrary code with SYSTEM-level privilege...

Microsoft Protected Extensible Authentication Protocol Authentication Bypass Vulnerability

Description The implementation of the Protected Extensible Authentication Protocol PEAP used by Microsoft's Internet Authentication System is prone to an authentication-bypass vulnerability. Successful exploits would allow an attacker to gain unauthorized access to network resources. Technologies...

CVE-2008-1113

Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol PEAP, does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

Authentication flaw

Vocera Communications wireless handsets, when using Protected Extensible Authentication Protocol PEAP, do not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

Authentication flaw

Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol PEAP, does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

CVE-2008-1113

Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol PEAP, does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

CVE-2008-1113

CVE-2008-1113 affects Cisco Unified Wireless IP Phone 7921 when using PEAP: the device does not validate server certificates, enabling remote wireless access points to capture hashed passwords and perform MITM attacks. The description is consistent across NVD and Red Hat/other references. The con...

CVE-2008-1114

Vocera Communications wireless handsets, when using Protected Extensible Authentication Protocol PEAP, do not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

CVE-2008-1114

CVE-2008-1114 affects Vocera Communications wireless handsets when using PEAP; the client fails to validate the server certificate, enabling a remote wireless access point to perform MITM attacks and potentially capture hashed passwords. Root cause: lack of server-certificate validation in PEAP a...