CVE-2009-3677: Code Injection
The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request, which allows remote attackers to access network resources via a malformed request, aka "MS-CHAP Authentication Bypass Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3677?
CVE-2009-3677 has a moderate severity rating due to its potential impact on system authentication.
How do I fix CVE-2009-3677?
To fix CVE-2009-3677, apply the latest security updates provided by Microsoft for the affected Windows versions.
Which versions of Windows are affected by CVE-2009-3677?
CVE-2009-3677 affects Windows 2000 SP4, XP SP2, XP SP3, Server 2003 SP2, Vista Gold, Vista SP1, and Server 2008.
What exploits are associated with CVE-2009-3677?
CVE-2009-3677 can be exploited remotely to bypass authentication in the MS-CHAP v2 PEAP authentication process.
Is there a workaround for CVE-2009-3677?
While the best practice is to apply security updates, temporarily disabling MS-CHAP v2 may serve as a workaround until the updates are applied.