CVE-2010-0239

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Router Advertisement packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "ICMPv6 Router Advertisement Vulnerability."

References

http://www.us-cert.gov/cas/techalerts/TA10-040A.html

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-009

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8478

Details

Source: MITRE

Published: 2010-02-10

Updated: 2018-10-12

Type: CWE-94

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (2 total)

IDNameProductFamilySeverity
108811Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)NessusWindows
critical
44419MS10-009: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (974145)NessusWindows : Microsoft Bulletins
critical