The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 uses predictable transaction IDs that are formed by incrementing a previous ID by 1, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerability than CVE-2010-0024 and CVE-2010-0025.

The installed version of Microsoft Exchange / Windows SMTP Service is affected by at least one vulnerability :

  - Incorrect parsing of DNS Mail Exchanger (MX) resource     records could cause the Windows Simple Mail Transfer     Protocol (SMTP) component to stop responding until     the service is restarted. (CVE-2010-0024)

  - Improper allocation of memory for interpreting SMTP     command responses may allow an attacker to read random     email message fragments stored on the affected server.
    (CVE-2010-0025)

  - Predictable transaction IDs are used, which could allow     a man-in-the-middle attacker to spoof DNS responses.
    (CVE-2010-1689)

  - There is no verification that the transaction ID of a     response matches the transaction ID of a query, which     could allow a man-in-the-middle attacker to spoof DNS     responses. (CVE-2010-1690)

ID	Name	Product	Family	Severity
108800	MS10-024: Microsoft Exchange Denial of Service (uncredentialed)	Nessus	Windows	medium
45511	MS10-024: Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service (981832)	Nessus	Windows : Microsoft Bulletins	medium

Detections

Analytics

CVE-2010-1689

high

Tenable Plugins

medium

medium