CVE-2016-0050: Input Validation

Published Feb 10, 2016

Updated

Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests, aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

Affected Software

6 affected components

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012=gold

Microsoft Windows Server 2012=r2

Event History

Feb 10, 2016

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0050?

CVE-2016-0050 has been rated as Important severity by Microsoft.

How do I fix CVE-2016-0050?

To remediate CVE-2016-0050, apply the security updates provided in Microsoft's MS16-021 bulletin.

What systems are affected by CVE-2016-0050?

CVE-2016-0050 affects Microsoft Windows Server 2008 SP2, R2 SP1, and Windows Server 2012 Gold and R2.

What kind of attack does CVE-2016-0050 allow?

CVE-2016-0050 allows remote attackers to perform denial of service attacks against RADIUS authentication.

Is CVE-2016-0050 a local or remote vulnerability?

CVE-2016-0050 is considered a remote vulnerability, allowing attackers to exploit it over the network.