Vulnerabilities > CVE-2010-0024 - Improper Input Validation vulnerability in Microsoft products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
microsoft
CWE-20
nessus
NVD
Published: 2010-04-14
Updated: 2020-04-09

Summary

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability."

Vulnerable Configurations

Part Description Count
OS
Microsoft
11
Application
Microsoft
5

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Msbulletin

bulletin_idMS10-024
bulletin_url
date2010-04-13T00:00:00
impactDenial of Service
knowledgebase_id981832
knowledgebase_url
severityImportant
titleVulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS10-024.NASL
    descriptionThe installed version of Microsoft Exchange / Windows SMTP Service is affected by at least one vulnerability : - Incorrect parsing of DNS Mail Exchanger (MX) resource records could cause the Windows Simple Mail Transfer Protocol (SMTP) component to stop responding until the service is restarted. (CVE-2010-0024) - Improper allocation of memory for interpreting SMTP command responses may allow an attacker to read random email message fragments stored on the affected server. (CVE-2010-0025) - Predictable transaction IDs are used, which could allow a man-in-the-middle attacker to spoof DNS responses. (CVE-2010-1689) - There is no verification that the transaction ID of a response matches the transaction ID of a query, which could allow a man-in-the-middle attacker to spoof DNS responses. (CVE-2010-1690)
    last seen2020-06-01
    modified2020-06-02
    plugin id45511
    published2010-04-13
    reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45511
    titleMS10-024: Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service (981832)
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(45511);
  script_version("1.27");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id(
    "CVE-2010-0024",
    "CVE-2010-0025",
    "CVE-2010-1689",
    "CVE-2010-1690"
  );
  script_bugtraq_id(39308, 39381, 39908, 39910);
  script_xref(name:"MSFT", value:"MS10-024");
  script_xref(name:"IAVB", value:"2010-B-0029");
  script_xref(name:"MSKB", value:"976323");
  script_xref(name:"MSKB", value:"976702");
  script_xref(name:"MSKB", value:"976703");
  script_xref(name:"MSKB", value:"981383");
  script_xref(name:"MSKB", value:"981401");
  script_xref(name:"MSKB", value:"981407");

  script_name(english:"MS10-024: Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service (981832)");
  script_summary(english:"Checks versions of Smtpsvc.dll or Exchange-specific files");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote mail server may be affected by multiple vulnerabilities."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The installed version of Microsoft Exchange / Windows SMTP Service
is affected by at least one vulnerability :

  - Incorrect parsing of DNS Mail Exchanger (MX) resource
    records could cause the Windows Simple Mail Transfer
    Protocol (SMTP) component to stop responding until
    the service is restarted. (CVE-2010-0024)

  - Improper allocation of memory for interpreting SMTP
    command responses may allow an attacker to read random
    email message fragments stored on the affected server.
    (CVE-2010-0025)

  - Predictable transaction IDs are used, which could allow
    a man-in-the-middle attacker to spoof DNS responses.
    (CVE-2010-1689)

  - There is no verification that the transaction ID of a
    response matches the transaction ID of a query, which
    could allow a man-in-the-middle attacker to spoof DNS
    responses. (CVE-2010-1690)"
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-024");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
and 2008 as well as Exchange Server 2000, 2003, 2007, and 2010."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/04/13");

  script_set_attribute(attribute:"plugin_type", value:"local");

  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}

include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS10-024';
kbs = make_list("976323", "976702", "976703", "981383", "981401", "981407");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows Server 2008 R2
  hotfix_is_vulnerable(os:"6.1",       arch:"x64", file:"Smtpsvc.dll", version:"7.5.7600.20660", min_version:"7.5.7600.20000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||
  hotfix_is_vulnerable(os:"6.1",       arch:"x64", file:"Smtpsvc.dll", version:"7.5.7600.16544", min_version:"7.5.7600.16000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||

  # Windows 2008
  hotfix_is_vulnerable(os:"6.0", sp:2,             file:"Smtpsvc.dll", version:"7.0.6002.22354", min_version:"7.0.6002.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||
  hotfix_is_vulnerable(os:"6.0", sp:2,             file:"Smtpsvc.dll", version:"7.0.6002.18222", min_version:"7.0.6002.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||
  hotfix_is_vulnerable(os:"6.0", sp:1,             file:"Smtpsvc.dll", version:"7.0.6001.22648", min_version:"7.0.6001.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||
  hotfix_is_vulnerable(os:"6.0", sp:1,             file:"Smtpsvc.dll", version:"7.0.6001.18440", min_version:"7.0.6001.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||

  # Windows 2003 / XP x64
  hotfix_is_vulnerable(os:"5.2", sp:2,             file:"Smtpsvc.dll", version:"6.0.3790.4675",                                dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||

  # Windows XP x86
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Smtpsvc.dll", version:"6.0.2600.5949",                                dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Smtpsvc.dll", version:"6.0.2600.3680",                                dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323") ||

  # Windows 2000
  hotfix_is_vulnerable(os:"5.0",                   file:"Smtpsvc.dll", version:"5.0.2195.7381",                                dir:"\system32\inetsrv", bulletin:bulletin, kb:"976323")
  )
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_warning();

  hotfix_check_fversion_end();
  exit(0);
}

# Check Exchange Server.
version = get_kb_item("SMB/Exchange/Version");
if (version)
{
  # 2000
  if (version == 60)
  {
    sp = get_kb_item("SMB/Exchange/SP");
    if (sp && sp > 3)
    {
      hotfix_check_fversion_end();
      exit(0, "Exchange Server 2000 Service Pack "+sp+" is installed and thus not affected.");
    }

    rootfile = get_kb_item("SMB/Exchange/Path");
    if (!rootfile)
    {
      hotfix_check_fversion_end();
      audit(AUDIT_KB_MISSING, 'SMB/Exchange/Path');
    }
    rootfile = rootfile + "\bin";

    if (
      hotfix_check_fversion(path:rootfile, file:"Mdbmsg.dll", version:"6.0.6620.15", bulletin:bulletin, kb:"976703") == HCF_OLDER ||
      hotfix_check_fversion(path:rootfile, file:"Store.exe",  version:"6.0.6620.15", bulletin:bulletin, kb:"976703") == HCF_OLDER
    )
    {
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_warning();

      hotfix_check_fversion_end();
      exit(0);
    }
  }
  # 2003
  else if (version == 65)
  {
    sp = get_kb_item ("SMB/Exchange/SP");
    if (sp && sp > 2)
    {
      hotfix_check_fversion_end();
      exit(0, "Exchange Server 2003 Service Pack "+sp+" is installed and thus not affected.");
    }

    rootfile = get_kb_item("SMB/Exchange/Path");
    if (!rootfile)
    {
      hotfix_check_fversion_end();
      audit(AUDIT_KB_MISSING, 'SMB/Exchange/Path');
    }
    rootfile = rootfile + "\bin";

    if (
      hotfix_check_fversion(path:rootfile, file:"Msgfilter.dll", version:"6.5.7656.2", bulletin:bulletin, kb:"976702") == HCF_OLDER ||
      hotfix_check_fversion(path:rootfile, file:"Turflist.dll",  version:"6.5.7656.2", bulletin:bulletin, kb:"976702") == HCF_OLDER
    )
    {
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_warning();

      hotfix_check_fversion_end();
      exit(0);
    }
  }
  # 2007
  else if (version == 80)
  {
    sp = get_kb_item ("SMB/Exchange/SP");
    if (sp && sp > 2)
    {
      hotfix_check_fversion_end();
      exit(0, "Exchange Server 2007 Service Pack "+sp+" is installed and thus not affected.");
    }

    rootfile = get_kb_item("SMB/Exchange/Path");
    if (!rootfile)
    {
      hotfix_check_fversion_end();
      audit(AUDIT_KB_MISSING, 'SMB/Exchange/Path');
    }
    rootfile = rootfile + "\bin";

    dll = "Microsoft.Exchange.Setup.Common.dll";
    if (
      hotfix_check_fversion(path:rootfile, file:dll, version:"8.2.254.0", min_version:"8.2.0.0", bulletin:bulletin, kb:"981383") == HCF_OLDER ||
      hotfix_check_fversion(path:rootfile, file:dll, version:"8.1.436.0", min_version:"8.1.0.0", bulletin:bulletin, kb:"981407") == HCF_OLDER
    )
    {
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_warning();

      hotfix_check_fversion_end();
      exit(0);
    }
  }
  # 2010
  else if (version == 140)
  {
    sp = get_kb_item ("SMB/Exchange/SP");
    if (sp && sp > 0)
    {
      hotfix_check_fversion_end();
      exit(0, "Exchange Server 2010 Service Pack "+sp+" is installed and thus not affected.");
    }

    rootfile = get_kb_item("SMB/Exchange/Path");
    if (!rootfile)
    {
      hotfix_check_fversion_end();
      audit(AUDIT_KB_MISSING, 'SMB/Exchange/Path');
    }
    rootfile = rootfile + "\bin";

    if (
      hotfix_check_fversion(path:rootfile, file:"Microsoft.Exchange.Diagnostics.dll",  version:"14.0.694.0", bulletin:bulletin, kb:"981401") == HCF_OLDER ||
      hotfix_check_fversion(path:rootfile, file:"Microsoft.Exchange.Setup.Common.dll", version:"14.0.694.0", bulletin:bulletin, kb:"981401") == HCF_OLDER
    )
    {
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_warning();

      hotfix_check_fversion_end();
      exit(0);
    }
  }
}

hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
  • NASL familyWindows
    NASL idEXCHANGE_MS10-024.NASL
    descriptionThe installed version of Microsoft Exchange / Windows SMTP Service is affected by at least one vulnerability : - Incorrect parsing of DNS Mail Exchanger (MX) resource records could cause the Windows Simple Mail Transfer Protocol (SMTP) component to stop responding until the service is restarted. (CVE-2010-0024) - Improper allocation of memory for interpreting SMTP command responses may allow an attacker to read random email message fragments stored on the affected server. (CVE-2010-0025) - Predictable transaction IDs are used, which could allow a man-in-the-middle attacker to spoof DNS responses. (CVE-2010-1689) - There is no verification that the transaction ID of a response matches the transaction ID of a query, which could allow a man-in-the-middle attacker to spoof DNS responses. (CVE-2010-1690)
    last seen2020-06-01
    modified2020-06-02
    plugin id108800
    published2018-04-03
    reporterThis script is Copyright (C) 2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/108800
    titleMS10-024: Microsoft Exchange Denial of Service (uncredentialed)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(108800);
  script_version("1.5");
  script_cvs_date("Date: 2018/11/15 20:50:26");

  script_cve_id(
    "CVE-2010-0024",
    "CVE-2010-0025",
    "CVE-2010-1689",
    "CVE-2010-1690");

  script_bugtraq_id(
    39308,
    39381,
    39908,
    39910
  );
  script_xref(name:"MSFT", value:"MS10-024");
  script_xref(name:"IAVB", value:"2010-B-0029");
  script_xref(name:"MSKB", value:"976323");
  script_xref(name:"MSKB", value:"976702");
  script_xref(name:"MSKB", value:"976703");
  script_xref(name:"MSKB", value:"981383");
  script_xref(name:"MSKB", value:"981401");
  script_xref(name:"MSKB", value:"981407");

  script_name(english:"MS10-024: Microsoft Exchange Denial of Service (uncredentialed)");
  script_summary(english:"Checks the version of Exchange");

  script_set_attribute(attribute:"synopsis", value:
"The remote mail server may be affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The installed version of Microsoft Exchange / Windows SMTP Service
is affected by at least one vulnerability :

  - Incorrect parsing of DNS Mail Exchanger (MX) resource
    records could cause the Windows Simple Mail Transfer
    Protocol (SMTP) component to stop responding until
    the service is restarted. (CVE-2010-0024)

  - Improper allocation of memory for interpreting SMTP
    command responses may allow an attacker to read random
    email message fragments stored on the affected server.
    (CVE-2010-0025)

  - Predictable transaction IDs are used, which could allow
    a man-in-the-middle attacker to spoof DNS responses.
    (CVE-2010-1689)

  - There is no verification that the transaction ID of a
    response matches the transaction ID of a query, which
    could allow a man-in-the-middle attacker to spoof DNS
    responses. (CVE-2010-1690)"
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-024");
  script_set_attribute(attribute:"solution",value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
and 2008 as well as Exchange Server 2000, 2003, 2007, and 2010.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/03");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:exchange_server");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2018 Tenable Network Security, Inc.");

  script_dependencies("exchange_detect.nbin");
  script_require_keys("installed_sw/Exchange Server");
  script_require_ports("Services/smtp", 25, "Services/pop3", 143, "Services/www", 80);
  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("vcf.inc");

appname = 'Exchange Server';
get_install_count(app_name:appname, exit_if_zero:TRUE);

smtp_ports = get_kb_list("Services/smtp");
pop3_ports = get_kb_list("Services/pop3");
http_ports = get_kb_list("Services/www");

ports = make_list(smtp_ports, pop3_ports, http_ports);
port = branch(ports);
app_info = vcf::get_app_info(app:appname, port:port, service:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  {"min_version" : "6.0.0", "fixed_version":"6.0.6620.15"},
  {"min_version" : "6.5.0", "fixed_version":"6.5.7656.2"},
  {"min_version" : "8.0.0", "fixed_version":"8.1.436.0"},
  {"min_version" : "8.2.0", "fixed_version":"8.2.254.0"},
  {"min_version" : "14.0.0","fixed_version":"14.0.694.0"}
];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
  • NASL familySMTP problems
    NASL idSMTP_KB981832.NASL
    descriptionThe installed version of Microsoft Exchange / Windows SMTP Service is affected by at least one vulnerability : - Incorrect parsing of DNS Mail Exchanger (MX) resource records could cause the Windows Simple Mail Transfer Protocol (SMTP) component to stop responding until the service is restarted. (CVE-2010-0024) - Improper allocation of memory for interpreting SMTP command responses may allow an attacker to read random email message fragments stored on the affected server. (CVE-2010-0025)
    last seen2020-06-01
    modified2020-06-02
    plugin id45517
    published2010-04-13
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45517
    titleChecks the remote SMTP server is patched for KB981832
    code
    #
# (C) Tenable Network Security, Inc.
#

# nb: script_name() is too long for Nessus 2.x.
if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");


if (description)
{
  script_id(45517);
  script_version("1.17");
  script_cvs_date("Date: 2018/11/15 20:50:24");

  script_cve_id("CVE-2010-0024", "CVE-2010-0025");
  script_bugtraq_id(39381);
  script_xref(name:"MSFT", value:"MS10-024");
  script_xref(name:"IAVB", value:"2010-B-0029");
  script_xref(name:"MSKB", value:"981832");

  script_name(english:"MS10-024: Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service (981832) (uncredentialed check)");
  script_summary(english:"Checks the remote SMTP server is patched for KB981832");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote mail server may be affected by multiple vulnerabilities."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The installed version of Microsoft Exchange / Windows SMTP Service
is affected by at least one vulnerability :

  - Incorrect parsing of DNS Mail Exchanger (MX) resource
    records could cause the Windows Simple Mail Transfer
    Protocol (SMTP) component to stop responding until 
    the service is restarted. (CVE-2010-0024)

  - Improper allocation of memory for interpreting SMTP
    command responses may allow an attacker to read random 
    email message fragments stored on the affected server.
    (CVE-2010-0025)"
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-024");
  script_set_attribute(
    attribute:"solution", 
    value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
and 2008 as well as Exchange Server 2000, 2003, 2007, and 2010."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/04/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/04/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:exchange_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SMTP problems");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencie("smtpserver_detect.nasl", "doublecheck_std_services.nasl");
  script_require_ports("Services/smtp", 25);

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("smtp_func.inc");

last_vers = NULL;

function _vers_cmp(a,b)
{
 local_var i, c;

 a = split(a, sep:'.', keep:FALSE);
 c = b;
 b = split(b, sep:'.', keep:FALSE);
 last_vers = NULL;

 if ( max_index(a) != 4 || max_index(b) != 4 ) return 0; # ???

 for ( i = 0 ; i < 4; i ++ )
 {
   if ( int(a[i]) != int(b[i]) ) 
   {
	 if ( i < 3 ) return 0; # Only compare the maj version
  	 last_vers = c;
	 return int(a[i]) - int(b[i]);
   }
 } 
 return 0;
}


function vers_cmp(ref, version, min)
{
 if ( _vers_cmp(a:version, b:min) < 0 ) return 0;
 return _vers_cmp(a:version, b:ref);
}

port = get_service(svc:"smtp", default:25, exit_on_fail:TRUE);
if (!get_port_state(port)) exit(0, "Port "+port+" is not open.");

banner = get_smtp_banner(port:port);
if ( ! banner ) exit(1, "Nessus failed to extract the greeting from the SMTP server on port "+port+".");
line = egrep(pattern:"^220 .* Microsoft ESMTP MAIL Service, Version: ([0-9.]+) ready at.*", string:banner);
if ( ! line ) exit(0, "The greeting from the SMTP server on port "+port+" does not look like Microsoft's SMTP service.");

version = chomp(ereg_replace(pattern:"^220 .* Microsoft ESMTP MAIL Service, Version: ([0-9.]+) ready at.*", string:line, replace:"\1"));

if ( 
     # Windows 2000
     vers_cmp(version:version, ref:"5.0.2195.7381", min:"5.0.2195.0") < 0 ||
     # Windows 2003, XP x64
     vers_cmp(version:version, ref:"6.0.3790.4675", min:"6.0.3790.0") < 0 ||
     # Windows XP SP2
     vers_cmp(version:version, ref:"6.0.2600.3680", min:"6.0.2600.0") < 0 ||
     # Windows XP SP3
     vers_cmp(version:version, ref:"6.0.2600.5949", min:"6.0.2600.5000") < 0 ||
     #Windows 2008
     vers_cmp(version:version, ref:"7.0.6001.18440", min:"7.0.6001.0") < 0 ||
     vers_cmp(version:version, ref:"7.0.6001.22648", min:"7.0.6001.22000") < 0 ||
     vers_cmp(version:version, ref:"7.0.6002.18222", min:"7.0.6002.0") < 0 ||
     vers_cmp(version:version, ref:"7.0.6002.22354", min:"7.0.6002.22000") < 0 ||
     #Windows 2008 R2
     vers_cmp(version:version, ref:"7.5.7600.16544", min:"7.5.7600.0") < 0 ||
     vers_cmp(version:version, ref:"7.5.7600.20660", min:"7.5.7600.20000") < 0)
{
  security_warning(port:port, extra:'\nThe remote version of the smtpsvc.dll is ' + version + ' versus ' + last_vers + '.');
  exit(0);
}
else exit(0, "The SMTP server on port "+port+" uses smtpsvc.dll "+version+" and hence is not affected.");

Oval

accepted2014-08-18T04:06:23.290-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameDragos Prisaca
    organizationGideon Technologies, Inc.
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Windows 2000 is installed
    ovaloval:org.mitre.oval:def:85
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
    ovaloval:org.mitre.oval:def:396
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Exchange Server 2003 Service Pack 2 is installed
    ovaloval:org.mitre.oval:def:1869
descriptionThe SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability."
familywindows
idoval:org.mitre.oval:def:7067
statusaccepted
submitted2010-03-13T13:00:00
titleSMTP Server MX Record Vulnerability
version47

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 39308 CVE ID: CVE-2010-0024 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的SMTP组件处理特制的DNS邮件交换器（MX）资源记录的方式中存在拒绝服务漏洞。利用该漏洞的尝试不要求进行认证，攻击者可以通过向运行SMTP服务的计算机发送特制网络消息来利用该漏洞。成功利用此漏洞的攻击者可能会导致SMTP服务停止响应，直至重新启动。 Microsoft Exchange Server 2003 SP2 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2008 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000SP4 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-024）以及相应补丁: MS10-024：Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service (981832) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-024.mspx?pf=true
idSSV:19454
last seen2017-11-19
modified2010-04-14
published2010-04-14
reporterRoot
titleMicrosoft Windows SMTP Server组件MX记录解析拒绝服务漏洞（MS10-024）

References