CVE-2009-3677: Code Injection
First published: Wed Dec 09 2009(Updated: )
The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request, which allows remote attackers to access network resources via a malformed request, aka "MS-CHAP Authentication Bypass Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows 2000 | =sp4 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows XP | =sp3 | |
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows Vista | =sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-3677?
CVE-2009-3677 has a moderate severity rating due to its potential impact on system authentication.
How do I fix CVE-2009-3677?
To fix CVE-2009-3677, apply the latest security updates provided by Microsoft for the affected Windows versions.
Which versions of Windows are affected by CVE-2009-3677?
CVE-2009-3677 affects Windows 2000 SP4, XP SP2, XP SP3, Server 2003 SP2, Vista Gold, Vista SP1, and Server 2008.
What exploits are associated with CVE-2009-3677?
CVE-2009-3677 can be exploited remotely to bypass authentication in the MS-CHAP v2 PEAP authentication process.
Is there a workaround for CVE-2009-3677?
While the best practice is to apply security updates, temporarily disabling MS-CHAP v2 may serve as a workaround until the updates are applied.
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-historical
- agent/author
- agent/softwarecombine
- vendor/microsoft
- canonical/microsoft windows 2000
- version/microsoft windows 2000/sp4
- canonical/microsoft windows server
- version/microsoft windows server/sp2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp1
- canonical/microsoft windows xp
- version/microsoft windows xp/sp2
- version/microsoft windows xp/sp3