| Vulnerability Name: | CVE-2011-3406 (CCN-71559) | ||||||||
| Assigned: | 2011-12-13 | ||||||||
| Published: | 2011-12-13 | ||||||||
| Updated: | 2020-09-28 | ||||||||
| Summary: | Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka "Active Directory Buffer Overflow Vulnerability." | ||||||||
| CVSS v3 Severity: | 9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C) 6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-119 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-3406 Source: CCN Type: SA47202 Microsoft Windows Active Directory Query Processing Buffer Overflow Vulnerability Source: CCN Type: Microsoft Security Bulletin MS11-095 Vulnerability in Active Directory Could Allow Remote Code Execution (2640045) Source: CCN Type: Microsoft Security Bulletin MS13-032 Vulnerability in Active Directory Could Lead to Denial of Service (2830914) Source: CCN Type: Microsoft Security Bulletin MS14-016 Vulnerability in Security Account Manager Remote (SAMR) Protocol Could Allow Security Feature Bypass (2934418) Source: CCN Type: Microsoft Security Bulletin MS15-096 Vulnerability in Active Directory Service Could Allow Denial of Service (3072595) Source: CCN Type: Microsoft Security Bulletin MS16-047 Security Update for SAM and LSAD Remote Protocols (3148527) Source: CCN Type: Microsoft Security Bulletin MS16-081 Security Update for Active Directory (3160352) Source: CCN Type: Microsoft Security Bulletin MS16-110 Security Update for Windows (3178467) Source: CCN Type: BID-50959 Microsoft Active Directory CVE-2011-3406 Buffer Overflow Vulnerability Source: CERT Type: US Government Resource TA11-347A Source: MS Type: UNKNOWN MS11-095 Source: XF Type: UNKNOWN ms-win-active-directory-bo(71559) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:14037 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||