Vulnerability: MS09-064 - Critical Vulnerability in License Logging Server Could Allow Remote Code Execution
Back to Latest vulnerabilities homepage
Click any highlighted term for further explanation.
| Details | |
|---|---|
| Vulnerability name/brief description | MS09-064 - Critical Vulnerability in License Logging Server Could Allow Remote Code Execution |
| CVE/CAN name | |
| Vendor threat level | Critical |
| SophosLabs threat level | Medium |
| Solution | |
| Vendor description | This security update resolves a privately reported vulnerability in Microsoft Windows 2000. The vulnerability could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system. |
| SophosLabs comments | This update resolves a remote code execution vulnerability in License Logging Service for Microsoft Windows 2000 Server ( service pack 4 ). Attackers exploiting this vulnerability via RPC could potentially take complete control of a vulnerable system. Microsoft have stated that CVE-2009-2523 has not been publicly disclosed, and this has been a contributing factor in assigning the SophosLabs threat level of medium. We advise users to apply this patch at their earliest convenience. |
| SophosLabs testing result | N/A |
| Currently known exploits | At the time of writing SophosLabs have not observed any malware attempting to exploit this vulnerability. Should this situation change samples will be analyzed and we will take action as necessary. |
| First sample seen | N/A |
| Discovery date | November 10 2009 |
| Affected software | Microsoft Windows 2000 Server Service Pack 4 |
| References | http://www.microsoft.com/technet/security/Bulletin/MS09-064.mspx http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2523 |
| Credits | Microsoft MAPP Cody Pierce of TippingPoint DVLabs |
| Revisions | November 10 2009 - Initial Analysis Written |
Explanation of terms
Vulnerability Name/Brief Description:
Vendor identifier plus a brief description of the type of attack.
CVE/CAN Name:
Currently assigned CVE name. If a CVE name doesn't exist the CAN name will be used until a CVE has been assigned.
Vendor Threat Level:
Threat level assigned by the vendor
SophosLabs Threat Level:
Threat level assigned by SophosLabs
- LOW RISK - There is little chance of this vulnerability being actively exploited by malware.
- MEDIUM RISK - There is a possibility of this vulnerability being actively exploited by malware.
- HIGH RISK - There is a strong possibility of this vulnerability being actively exploited by malware.
- CRITICAL RISK - This vulnerability will almost certainly be actively exploited by malware.
Solution:
Vendor-supplied Patch identifier and recommended solution, or workaround if applicable.
Vendor Description:
Summary of the cause and potential effect of the vulnerability provided by the vendor.
SophosLabs Comments:
SophosLabs' opinions and observations of the vulnerability in question.
SophosLabs Testing Result:
Details of completed lab testing, if applicable. Please note that the lab test environment may differ significantly from user environments.
Currently Known Exploits:
List of identities for known exploits, if applicable.
First Sample Seen:
Date of the first sample seen by SophosLabs.
Discovery Date:
Date of the earliest known publically disclosed advisory.
Affected Software:
Vulnerable platforms and software versions.
If you need more information or guidance, then please contact technical support.
- Article ID: 66380
- Created: 10 Nov 2009
- Last updated: 10 Nov 2009
