CVE-2010-1690

Related Files

Core Security Technologies Advisory 2010.0427

Posted May 5, 2010

Authored by Core Security Technologies | Site coresecurity.com

Core Security Technologies Advisory - Prior to MS10-024 the Windows SMTP Service generated DNS queries with trivially guessable values in the transaction ID field. The issue was addressed in MS10-024 by adding a call to the 'CAsyncDns::GenerateRandWord' method when building the DNS query. Prior to MS10-024 the Windows SMTP Service did not check that the value of the ID field of a DNS response received from the network actually matched the value of the ID field of a corresponding DNS query packet previously sent. The issue was addressed in MS10-024 by adding validation logic to the 'CAsyncDns::ProcessReadIO' method.

tags | advisory

systems | windows

advisories | CVE-2010-1689, CVE-2010-1690

SHA-256 | f9f3d7f24dfb5f26df59a62a6054cd9aaf1939a9958a82a13d2f856165222d6a

Download | Favorite | View