CVE-2009-2509

Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution in ADFS Vulnerability."

CVSS v2.0 9.0 HIGH

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/cas/techalerts/TA09-342A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441
http://www.us-cert.gov/cas/techalerts/TA09-342A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::

History

21 Nov 2024, 01:05

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/cas/techalerts/TA09-342A.html - US Government Resource~~	() http://www.us-cert.gov/cas/techalerts/TA09-342A.html - US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070 -
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441 -

Information

Published : 2009-12-09 18:30

Updated : 2024-11-21 01:05

NVD link : CVE-2009-2509

Mitre link : CVE-2009-2509

CVE.ORG link : CVE-2009-2509

JSON object : View

Products Affected

microsoft

windows_server_2008
windows_server_2003

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2009-2509", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-12-09T18:30:00.377", "references": [{"url": "http://www.us-cert.gov/cas/techalerts/TA09-342A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA09-342A.html", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka \"Remote Code Execution in ADFS Vulnerability.\""}, {"lang": "es", "value": "Active Directory Federation Services (ADFS) en Microsoft Windows Server 2003 SP2 y Server 2008 Gold y SP2 no valida adecuadamente las cabeceras en peticiones HTTP, lo que permite a atacantes remotos autenticados ejecutar c\u00f3digo de su elecci\u00f3n mediante una petici\u00f3n manipulada a un servidor web IIS. Tambi\u00e9n conocido como \"Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remoto en ADFS\"."}], "lastModified": "2024-11-21T01:05:02.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CFB1A97-8042-4497-A45D-C014B5E240AB"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F9C7616-658D-409D-8B53-AC00DC55602A"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8A32637-65EC-42C4-A892-0E599562527C"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFF81F4B-7D92-4398-8658-84530FB8F518"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}