The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state information, which allows remote attackers to execute arbitrary code by sending packets to a listening service, and thereby triggering misinterpretation of an unspecified field as a function pointer, aka "TCP/IP Timestamps Code Execution Vulnerability."
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.us-cert.gov/cas/techalerts/TA09-251A.html - US Government Resource | |
| References | () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048 - | |
| References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6374 - |
07 Dec 2023, 18:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:* |
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* |
Information
Published : 2009-09-08 22:30
Updated : 2025-04-09 00:30
NVD link : CVE-2009-1925
Mitre link : CVE-2009-1925
CVE.ORG link : CVE-2009-1925
JSON object : View
Products Affected
microsoft
- windows_server_2008
- windows_2000
- windows_vista
- windows_server_2003
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')