Lucene search

[email protected]CVE-2009-2526

HistoryOct 14, 2009 - 10:30 a.m.

CVE-2009-2526

2009-10-1410:30:01

CWE-399

[email protected]

web.nvd.nist.gov

microsoft

windows

vista

server 2008

smbv2

infinite loop

vulnerability

denial of service

cve-2009-2526

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

6.3 Medium

AI Score

Confidence

High

0.752 High

EPSS

Percentile

98.2%

JSON

Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service, aka “SMBv2 Infinite Loop Vulnerability.”

Affected configurations

NVD

Node

microsoftwindows_server_2008itanium

microsoftwindows_server_2008x32

microsoftwindows_server_2008x64

microsoftwindows_server_2008Match-

microsoftwindows_server_2008Match-sp2

microsoftwindows_server_2008Match-sp2itanium

microsoftwindows_server_2008Match-sp2x64

microsoftwindows_server_2008Match-sp2x86

microsoftwindows_vista

microsoftwindows_vistax64

microsoftwindows_vistasp1

microsoftwindows_vistasp2

microsoftwindows_vistaMatch-sp1

microsoftwindows_vistaMatch-sp2

CPENameOperatorVersion
microsoft:windows_server_2008microsoft windows server 2008eq*
microsoft:windows_server_2008microsoft windows server 2008eq-
microsoft:windows_vistamicrosoft windows vistaeq*
microsoft:windows_vistamicrosoft windows vistaeq-

CPE	Name	Operator	Version
microsoft:windows_server_2008	microsoft windows server 2008	eq	*
microsoft:windows_server_2008	microsoft windows server 2008	eq	-
microsoft:windows_vista	microsoft windows vista	eq	*
microsoft:windows_vista	microsoft windows vista	eq	-