CVE-2009-2505: Critical severity microsoft windows server vulnerability

Published Dec 9, 2009

Updated

The Internet Authentication Service (IAS) in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed request, aka "Internet Authentication Service Memory Corruption Vulnerability."

Affected Software

5 affected components

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=sp2-x32

Microsoft Windows Server 2008=sp2-x64

Microsoft Windows Vista=sp2

Event History

Dec 9, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2505?

CVE-2009-2505 is considered critical due to its potential to allow remote code execution.

How do I fix CVE-2009-2505?

To remediate CVE-2009-2505, implementing the latest security updates from Microsoft is necessary.

Which versions of Windows are affected by CVE-2009-2505?

CVE-2009-2505 affects Microsoft Windows Vista SP2 and Windows Server 2008 SP2.

What type of attack does CVE-2009-2505 facilitate?

CVE-2009-2505 allows remote attackers to execute arbitrary code through malformed requests.

Is CVE-2009-2505 related to authentication protocols?

Yes, CVE-2009-2505 involves vulnerabilities in MS-CHAP v2 Protected Extensible Authentication Protocol.