| Vulnerability Name: | CVE-2009-0098 (CCN-47670) | ||||||||
| Assigned: | 2009-02-10 | ||||||||
| Published: | 2009-02-10 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability." | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-399 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2009-0098 Source: OSVDB Type: UNKNOWN 51837 Source: CCN Type: SA33838 Exchange Server TNEF Decoding and MAPI Command Processing Vulnerabilities Source: SECUNIA Type: UNKNOWN 33838 Source: CCN Type: ASA-2009-054 MS09-003 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (959239) Source: CCN Type: IBM Internet Security Systems Protection Alert February 10, 2009 Microsoft Exchange Server TNEF Remote Code Execution Source: CCN Type: Microsoft Security Bulletin MS09-003 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (959239) Source: CCN Type: OSVDB ID: 51837 Microsoft Exchange Server Message Transport Neutral Encapsulation Format (TNEF) Decoding Remote Code Execution Source: CCN Type: BID-33134 Microsoft Exchange Server TNEF Decoding Remote Code Execution Vulnerability Source: CERT Type: US Government Resource TA09-041A Source: MS Type: UNKNOWN MS09-003 Source: XF Type: UNKNOWN exchange-tnef-code-execution(47670) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:6114 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||