| ID |
CVE-2009-0077
|
| Summary |
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability." |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:microsoft:forefront_threat_management_gateway:-:-:medium_business:*:*:*:*:*
cpe:2.3:a:microsoft:forefront_threat_management_gateway:-:-:medium_business:*:*:*:*:*
-
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:enterprise:*:*:*:*:*
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:enterprise:*:*:*:*:*
-
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:standard:*:*:*:*:*
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:standard:*:*:*:*:*
-
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:sp1:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:supportability:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:supportability:*:*:*:*:*:*
|
| CVSS |
| Base: | 5.0 (as of 12-10-2018 - 21:49) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
LOW |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
NONE |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
| msbulletin
via4
|
| bulletin_id | MS09-016 | | bulletin_url | | | date | 2009-04-14T00:00:00 | | impact | Denial of Service | | knowledgebase_id | 961759 | | knowledgebase_url | | | severity | Important | | title | Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service |
|
| oval
via4
|
| accepted | 2014-06-30T04:11:14.322-04:00 | | class | vulnerability | | contributors | | name | Dragos Prisaca | | organization | Gideon Technologies, Inc. |
| name | Brendan Miles | | organization | The MITRE Corporation |
| name | Josh Turpin | | organization | Symantec Corporation |
| name | Maria Mikhno | | organization | ALTX-SOFT |
| | definition_extensions | | comment | Microsoft Internet Security and Acceleration Server 2004 | | oval | oval:org.mitre.oval:def:5940 |
| comment | Microsoft Internet Security and Acceleration Server 2004 | | oval | oval:org.mitre.oval:def:5940 |
| comment | Microsoft Internet Security and Acceleration Server 2006 | | oval | oval:org.mitre.oval:def:6052 |
| comment | Microsoft Internet Security and Acceleration Server 2006 | | oval | oval:org.mitre.oval:def:6052 |
| comment | Microsoft Internet Security and Acceleration Server 2006 | | oval | oval:org.mitre.oval:def:6052 |
| | description | The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability." | | family | windows | | id | oval:org.mitre.oval:def:6068 | | status | accepted | | submitted | 2009-04-14T16:00:00 | | title | Web Proxy TCP State Limited Denial of Service Vulnerability | | version | 11 |
|
| refmap
via4
|
| cert | TA09-104A | | osvdb | 53636 | | sectrack | 1022045 | | secunia | 34687 | | vupen | ADV-2009-1030 |
|
| Last major update |
12-10-2018 - 21:49 |
| Published |
15-04-2009 - 08:00 |
| Last modified |
12-10-2018 - 21:49 |
