Microsoft Protected Extensible Authentication Protocol Authentication Bypass Vulnerability

Description The implementation of the Protected Extensible Authentication Protocol PEAP used by Microsoft's Internet Authentication System is prone to an authentication-bypass vulnerability. Successful exploits would allow an attacker to gain unauthorized access to network resources. Technologies...

PT-2009-4920 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 Description: The issue arises from the Graphics Device Interface GDI in the kernel not properly...

PT-2009-4921 · Microsoft · Windows Server 2003 +3

Name of the Vulnerable Software and Affected Versions: Windows 2000 SP4 Windows XP SP2 Windows XP SP3 Windows Server 2003 SP2 Description: A remote code execution issue exists due to the improper parsing of font code when building a table of directory entries. This allows remote attackers to...

Microsoft Windows Win32k内核态驱动本地权限提升（MS09-065）

BUGTRAQ ID: 36939,36941 CVE ID: CVE-2009-1127,CVE-2009-2513 Microsoft Windows是微软发布的非常流行的操作系统。 Windows系统中的Win32k内核态驱动（Win32k.sys）没有正确地验证传送给Windows内核系统调用的参数，以及用户态通过GDI内核组件所传送的输入。拥有有效的登录凭据且能够本地登录的攻击者可以利用这些漏洞执行任意内核态代码。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2...

Microsoft Security Bulletin MS09-065 - Critical Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947)

Microsoft Security Bulletin MS09-065 - Critical Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution 969947 Published: November 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in the...

Microsoft Security Bulletin MS09-066 - Important Vulnerability in Active Directory Could Allow Denial of Service (973309)

Microsoft Security Bulletin MS09-066 - Important Vulnerability in Active Directory Could Allow Denial of Service 973309 Published: November 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Active Directory directory...

Microsoft Active Directory LDAP Request Stack Exhaustion Denial Of Service Vulnerability

Description Microsoft Active Directory is prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash the server, denying access to legitimate users. Technologies Affected Avaya Meeting Exchange - Client Registration Server Avaya Meeting Exchange - Enterprise Edition...

Microsoft Windows Kernel GDI Data Validation Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. This issue affects the Graphics Device Interface GDI. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result ...

Microsoft Windows索引服务ActiveX控件内存破坏漏洞（MS09-057）

BUGTRAQ ID: 36629 CVECAN ID: CVE-2009-2507 Windows是微软发布的非常流行的操作系统。 Windows的索引服务所包含的ActiveX控件未正确处理特制Web内容，导致Windows系统上的索引服务中存在内存破坏漏洞。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows...

Microsoft Windows CryptoAPI组件整数溢出漏洞（MS09-056）

BUGTRAQ ID: 36577 CVECAN ID: CVE-2009-2511 Windows是微软发布的非常流行的操作系统。 Windows的CryptoAPI组件在解析X.509证书的ASN.1对象标识符时存在整数溢出漏洞，远程攻击者可以通过包含有畸形ASN.1对象标识符的X.509证书扮演称为其他用户或系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista...

CVE-2009-2516

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL pointer dereference during chain...

Input validation

The kernel in Microsoft Windows Server 2003 SP2 does not properly handle unspecified exceptions when an error condition occurs, which allows local users to cause a denial of service reboot via a crafted application, aka "Windows Kernel Exception Handler Vulnerability."...

CVE-2009-2503

CVE-2009-2503 is a GDI+ memory corruption vulnerability in Microsoft components that can be triggered by a crafted TIFF image file, enabling remote code execution. The weakness resides in how GDI+ allocates memory when processing TIFFs, affecting a wide range of Windows and Office products listed...

CVE-2009-2517

The kernel in Microsoft Windows Server 2003 SP2 does not properly handle unspecified exceptions when an error condition occurs, which allows local users to cause a denial of service reboot via a crafted application, aka "Windows Kernel Exception Handler Vulnerability."...

CVE-2009-2507

A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly process URLs, which allows remote attackers to execute arbitrary programs via unspecified vectors that cause a "vulnerable binary" to load and run, aka "Memory...

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution 974378 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves three privately reported...

Microsoft .NET Framework指针校验远程代码执行漏洞(MS09-059)

Bugraq ID: 36611 CVE ID：CVE-2009-0090 Microsoft .NET Framework是一个流行的软件开发工具包。 Microsoft .NET Framework存在一个远程代码执行漏洞，允许恶意Microsoft .NET应用程序获得一个可管理的指针给长久不使用的栈内存，恶意Microsoft .NET应用程序之后可使用此指针修改位于之后栈中的合法值，导致任意未管理的代码执行。 目前没有详细漏洞细节提供。 Microsoft .NET Framework 1.x Microsoft .NET Framework 2.x Microsoft .NE...

PT-2009-4911 · Microsoft · Office Excel Viewer +29

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 1.1 SP1 through 2.0 SP2 Windows XP versions SP2 through SP3 Windows Server 2003 version SP2 Windows Vista versions Gold through SP1 Windows Server 2008 version Gold Microsoft Office XP version SP3 Microsoft...

Microsoft Windows Media Player ASF文件处理远程代码执行漏洞(MS09-052)

Bugraq ID: 36644 CVE ID：CVE-2009-2527 Microsoft Windows Media Player是一款流行的媒体播放程序。 Windows Media Player 6.4存在远程代码执行漏洞，通过构建特殊的ASF文件，诱使用户使用Windows Media Player 6.4打开时可导致任意代码执行。 目前没有详细漏洞细节提供。 Microsoft Windows Media Player 6.4 用户可参考如下供应商提供的安全补丁： Microsoft Windows Media Player 6.4 Microsoft Security...

PT-2009-4922 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is caused by an integer underflow in the kernel, allowing local users to gain privileges via a crafted application. This occurs due to the incorrect truncation of a...