CVE-2010-3972

Published: Dec 23, 2010Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.

Affected (1)

Products: Microsoft: Internet Information Services

1 product

Internet Information Services

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Information Services	Version 7.5

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (20)

http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

Source: secure@microsoft.com

http://secunia.com/advisories/42713

Source: secure@microsoft.com

Vendor Advisory

http://www.exploit-db.com/exploits/15803

Source: secure@microsoft.com

Exploit

http://www.kb.cert.org/vuls/id/842372

Source: secure@microsoft.com

US Government Resource

http://www.securityfocus.com/bid/45542

Source: secure@microsoft.com

Exploit

http://www.securitytracker.com/id?1024921

Source: secure@microsoft.com

http://www.vupen.com/english/advisories/2010/3305

Source: secure@microsoft.com

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-004

Source: secure@microsoft.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/64248

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12370

Source: secure@microsoft.com

http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42713

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.exploit-db.com/exploits/15803

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.kb.cert.org/vuls/id/842372

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/bid/45542

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securitytracker.com/id?1024921

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/3305

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-004

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/64248

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12370

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.