CVE-2010-0240: Code Injection
First published: Wed Feb 10 2010(Updated: )
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used, does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "Header MDL Fragmentation Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =gold | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows Vista | =sp2 | |
| Microsoft Windows Vista | =sp2 | |
| Microsoft Windows Vista | =sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-0240?
CVE-2010-0240 is rated as critical due to its potential to allow remote code execution.
How do I fix CVE-2010-0240?
To fix CVE-2010-0240, you should apply the relevant security updates provided by Microsoft.
What versions of Windows are affected by CVE-2010-0240?
CVE-2010-0240 affects Microsoft Windows Vista (all versions) and Windows Server 2008 (all versions including SP1 and SP2).
What is the potential impact of exploiting CVE-2010-0240?
Exploiting CVE-2010-0240 can allow attackers to execute arbitrary code on the affected systems.
Are there any workarounds for CVE-2010-0240 until a fix is applied?
While there are no specific workarounds provided for CVE-2010-0240, limiting network exposure and disabling non-essential services can help mitigate risks.
- agent/author
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft windows server
- version/microsoft windows server/sp2
- version/microsoft windows server/gold
- canonical/microsoft windows vista
- version/microsoft windows vista/sp1
- version/microsoft windows vista/sp2