TA10-040A

MS10-009

oval:org.mitre.oval:def:8516

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The remote Windows host has the following vulnerabilities in its TCP/IP implementation :

  - Hosts with IPv6 enabled perform insufficient bounds     checking when processing specially crafted ICMPv6 Router     Advertisement packets.  A remote attacker could exploit     this to execute arbitrary code. (CVE-2010-0239)

  - Specially crafted Encapsulating Security Payloads (ESP)     are not processed properly.  A remote attacker could     exploit this to execute arbitrary code. (CVE-2010-0240)

  - Hosts with IPv6 enabled perform insufficient bounds     checking when processing specially crafted ICMPv6 Route     Information packets.  A remote attacker could exploit     this to execute arbitrary code. (CVE-2010-0241)

  - Specially crafted TCP packets with a malformed     selective acknowledgment (SACK) value can cause the     system to stop responding and automatically restart.  A     remote attacker could exploit this to cause a denial of     service. (CVE-2009-0242)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
44419	MS10-009: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (974145)	Nessus	Windows : Microsoft Bulletins	critical

CVE-2010-0241

high

Tenable Plugins

critical

critical