Vulnerability Name:

CVE-2010-0024 (CCN-57323)

Assigned:2009-12-14
Published:2010-04-13
Updated:2020-04-09
Summary:The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability."
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2010-0024

Source: CCN
Type: SA39376
Microsoft Exchange / Windows SMTP Service Two Vulnerabilities

Source: CCN
Type: Microsoft Security Bulletin MS10-024
Vulnerabilities in Microsoft Exchange and Windows SMTP Service could allow Denial of Service (981832)

Source: CCN
Type: Microsoft Security Bulletin MS10-106
Vulnerability in Microsoft Exchange Server Could Allow Denial of Service (2407132)

Source: CCN
Type: BID-39308
Microsoft Windows SMTP Server MX Record Denial of Service Vulnerability

Source: CERT
Type: Third Party Advisory, US Government Resource
TA10-103A

Source: MS
Type: Patch, Vendor Advisory
MS10-024

Source: XF
Type: UNKNOWN
ms-smtp-dnsmx-dos(57323)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:7067

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:microsoft:windows_2003_server:-:sp2:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

    • Configuration 5:
  • cpe:/a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2007:sp1:*:*:*:*:x64:*
  • OR cpe:/a:microsoft:exchange_server:2007:sp2:*:*:*:*:x64:*
  • OR cpe:/a:microsoft:exchange_server:2010:-:*:*:*:*:x64:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:7067
    V
    		SMTP Server MX Record Vulnerability
    2014-08-18
    BACK
    microsoft windows 2000 - sp4
    microsoft windows xp - sp2
    microsoft windows xp - sp2
    microsoft windows xp - sp3
    microsoft windows 2003 server - sp2
    microsoft windows server 2003 - sp2
    microsoft windows server 2008 -
    microsoft windows server 2008 - r2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 - sp2
    microsoft exchange server 2000 sp3
    microsoft exchange server 2003 sp2
    microsoft exchange server 2007 sp1
    microsoft exchange server 2007 sp2
    microsoft exchange server 2010 -
    microsoft windows 2000 - sp4
    microsoft windows xp sp2
    microsoft exchange server 2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows xp sp2
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows xp sp3
    microsoft windows server 2008 sp2
    microsoft windows server 2008 sp2
    microsoft windows server 2008 - r2
    microsoft windows server 2008